When exceptional access may be requested
Routine account support does not require reading customer content. If specific content is indispensable to resolve a case, a staff member must create a named request for one customer, one support purpose, exact data categories, a ticket reference, and a 15, 30, or 60 minute duration.
Two independent decisions
- 1
Customer decision
The customer approves or denies the request in Privacy controls. Silence never counts as approval.
- 2
Independent administrator review
A different administrator approves or denies. The requester cannot approve their own request.
- 3
Bounded use
Only the requester, named customer, approved categories, purpose, and active window qualify.
- 4
Automatic end
Expiry, denial, cancellation, or customer revocation closes the grant.
Evidence visible to the customer
The customer can see the reason, requester, approvers, duration, current state, revocation, and recorded data categories used under the grant. Reuse requires a new request.
Temporary runtime credential
A temporary privileged runtime credential remains while older background jobs are migrated. It is not a support-access mechanism, cannot use the lockbox tables, is frozen to existing allowlisted jobs, and is scheduled for removal rather than treated as permanent architecture.