Access management

Sencai gives you three related but distinct tools for managing who can do what: your organization’s standing roles, a view into the identities that exist inside your connected cloud accounts, and just-in-time elevation for temporary, time-boxed access into an organization you manage on someone else’s behalf.

Standing access: organization roles

Every member of your organization holds one role - Owner, Admin, Member, Auditor, or Viewer - that determines what they can do across the whole platform, security screens included. This is the access that persists day to day. See Roles for the full breakdown of what each role can do; this page focuses on the screens below it.

Cloud identity visibility

Security → Access Management (/gravity/access) is a cross-cloud inventory of the identities (human users, service accounts, managed identities, and groups) that exist inside the AWS, Azure, and GCP accounts you’ve connected - not your Sencai organization’s own members.

To populate it, select a compatible AWS, Azure, or GCP credential and run an IAM scan (the Run IAM Scan button). Only Owner or Admin can run a scan. The scan reads users, roles, and policies from the connected account and lists them here.

Each identity is flagged by how recently it was used:

Risk	Meaning
Active	Used within the last 30 days
Inactive	Not used in 30–90 days
Stale	Not used in over 90 days, or never

The Findings tab surfaces issues derived from that data (for example, a cluster of stale credentials), and the Per-Cloud tab breaks the same identities out by provider. Use Export CSV to pull the current view for an offline review or an audit request.

Note

This screen is about identities inside your cloud provider accounts, not about who has access to Sencai itself. For that, see Roles and the access reviews below.

Access reviews

Security → Access Reviews (/gravity/access/reviews) is a periodic certification workflow for your organization’s own member access - the standing roles described above - useful for SOC 2 / ISO 27001-style recurring access recertification.

The workflow:

1. An Admin or Owner creates a review (a name, a due date, and a reviewer), which snapshots your organization’s current members.
2. Launch starts the review - its status moves to in progress.
3. The assigned reviewer works through each member and records a decision: Keep, Revoke, or Downgrade, with an optional note.
4. Once every member has a decision, the reviewer marks the review Complete.

Caution

Recording Revoke or Downgrade on a review item is a decision, not an action - it does not automatically remove or change that member’s access. Follow through separately (from your organization’s member list) once the review is complete.

Just-in-time elevation

Just-in-time (JIT) elevation is for a specific scenario: your organization manages another organization’s resources (for example, as an agency or MSP - see Agency & MSP) and needs temporary access into that managed organization, rather than standing membership in it.

Note

JIT elevation is available on Professional and above. It isn’t included on the Starter plan - see Plans.

Requesting elevation

From Elevation Requests (/gravity/elevation/request - reached from a notification, or by navigating there directly), submit a request with:

• Your organization and the target (managed) organization’s ID
• Which capabilities you need (for example, read-only access to compute, or full read/write access to networks) - a limited, specific set, not a blanket “give me admin”
• A written justification
• A duration, from 15 minutes up to 8 hours

Approving requests

An Admin or Owner of the target organization reviews pending requests from Elevation Requests (/gravity/elevation/approve) and either Approves or Denys each one, with an optional reason for a denial. Your own submitted requests and their status appear on the same page.

Time-boxing and enforcement

An approved grant is only valid for the duration requested - it isn’t a permanent membership change. Enforcement is applied per operation: an active, approved grant unlocks the specific capabilities you were approved for on the operations that check for it, not a general “you’re in” switch.

The audit record

Every step - the request, the approval or denial, and the elevated access being used - is written to your organization’s audit trail. See Audit log for how to review or export that record.

What’s next

• Roles - the standing role model this page builds on
• Agency & MSP - managing other organizations, the scenario JIT elevation is built for
• Audit log - where every access decision above is recorded
• Plans - which tier includes JIT elevation