Skip to content

Just-in-Time (JIT) Access Policies for Granular, Time-Bound Control #5314

Closed

Description

@SonNgo2211

Is your feature request related to a problem? Please describe.
I'm frustrated when managing user access permissions in a Zero Trust environment because I have to manually revoke access after temporary tasks (like hotfixes or vendor maintenance) are completed. Currently, policies are static, which means if I forget to revoke permissions, those users retain standing privileges, creating a significant security risk if their accounts are compromised.

Describe the solution you'd like
I would like NetBird to implement Just-in-Time (JIT) Access Policies. This feature should allow administrators to define access rules that automatically expire after a specific duration. Ideally, this would include:

  • A "Time-to-Live (TTL)" or "Expiration Time" setting within the existing Policy engine.
  • A workflow to approve on-demand access requests that are time-bound.

Describe alternatives you've considered
Currently, the only alternative is manually creating a policy, monitoring the task, and manually deleting or disabling the policy afterward. This is time-consuming, prone to human error, and does not scale well with many vendors or emergency situations.

Similar functionality exists in other mesh VPN solutions (like Tailscale's capabilities). Implementing this would greatly enhance NetBird's security posture and make it more attractive for enterprise use cases where strict compliance (SOC2/ISO27001) regarding privileged access is required.

Activity

  1. alexschomb commented on Feb 22, 2026

    @alexschomb

    FYI this has been added to the last release of gravitl/netmaker as beta functionality: gravitl/netmaker@c2423bf

  2. SonNgo2211 commented on Feb 22, 2026

    @SonNgo2211
    Author

    FYI this has been added to the last release of gravitl/netmaker as beta functionality: gravitl/netmaker@c2423bf

    Thanks @alexschomb. I'd prefer to stay with NetBird, but if they don't support JIT soon, I'll definitely have to switch to Netmaker/Tailscale for that specific control.

  3. alexschomb commented on Feb 22, 2026

    @alexschomb

    FYI this has been added to the last release of gravitl/netmaker as beta functionality: gravitl/netmaker@c2423bf

    Thanks @alexschomb. I'd prefer to stay with NetBird, but if they don't support JIT soon, I'll definitely have to switch to Netmaker/Tailscale for that specific control.

    Agreed. Another downside is that this is Netmaker Enterprise only.

  4. thomashacker commented on Oct 1, 2026

    @thomashacker
    Collaborator

    Thanks for the request.

    NetBird now tracks feature requests in Discussions, explained in #6074, so this one is being converted to a discussion in Ideas and Feature Requests. Everything here moves with it, the write up and every comment, and it stays open for votes and replies. Nothing about it is being dismissed.

  5. locked and limited conversation to collaborators on Oct 1, 2026
  6. converted this issue into a discussion #7922 on Oct 1, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions