Just-in-Time (JIT) Access Policies for Granular, Time-Bound Control

[SonNgo2211]

Is your feature request related to a problem? Please describe.
I'm frustrated when managing user access permissions in a Zero Trust environment because I have to manually revoke access after temporary tasks (like hotfixes or vendor maintenance) are completed. Currently, policies are static, which means if I forget to revoke permissions, those users retain standing privileges, creating a significant security risk if their accounts are compromised.

Describe the solution you'd like
I would like NetBird to implement Just-in-Time (JIT) Access Policies. This feature should allow administrators to define access rules that automatically expire after a specific duration. Ideally, this would include:

• A "Time-to-Live (TTL)" or "Expiration Time" setting within the existing Policy engine.
• A workflow to approve on-demand access requests that are time-bound.

Describe alternatives you've considered
Currently, the only alternative is manually creating a policy, monitoring the task, and manually deleting or disabling the policy afterward. This is time-consuming, prone to human error, and does not scale well with many vendors or emergency situations.

Similar functionality exists in other mesh VPN solutions (like Tailscale's capabilities). Implementing this would greatly enhance NetBird's security posture and make it more attractive for enterprise use cases where strict compliance (SOC2/ISO27001) regarding privileged access is required.

[alexschomb]

FYI this has been added to the last release of gravitl/netmaker as beta functionality: gravitl/netmaker@c2423bf

[SonNgo2211]

FYI this has been added to the last release of gravitl/netmaker as beta functionality: gravitl/netmaker@c2423bf

Thanks @alexschomb. I'd prefer to stay with NetBird, but if they don't support JIT soon, I'll definitely have to switch to Netmaker/Tailscale for that specific control.

[alexschomb]

FYI this has been added to the last release of gravitl/netmaker as beta functionality: gravitl/netmaker@c2423bf

Thanks @alexschomb. I'd prefer to stay with NetBird, but if they don't support JIT soon, I'll definitely have to switch to Netmaker/Tailscale for that specific control.

Agreed. Another downside is that this is Netmaker Enterprise only.

[thomashacker]

Thanks for the request.

NetBird now tracks feature requests in Discussions, explained in #6074, so this one is being converted to a discussion in Ideas and Feature Requests. Everything here moves with it, the write up and every comment, and it stays open for votes and replies. Nothing about it is being dismissed.

[bigtcze]

I'd like to add, that this functionality is essential to achieve zero trust. Without it, policies in Netbird are just basic old-school FW rules.