Temporary elevation beats permanent admin

A standing admin or superuser role is a long-lived blast radius. The privilege sits there after the incident ends, ready to be copied, phished, or reused on a quiet afternoon. Prefer time-boxed elevation instead: just-in-time access with an explicit reason, a short time-to-live, and automatic expiry.

Treat the flow as a sequence, not a checkbox. Someone requests a specific action, not a role that lasts forever. A named approver reviews the reason and the scope. The system elevates only for the window that was approved. When the timer ends, the grant disappears without a cleanup ticket. An audit trail records who asked, who approved, what changed, and when access stopped.

Permanent "break glass" accounts still belong in a real incident plan, but they should be rare. Keep them separate from day-to-day roles, monitor every use, and do not share them as a second admin login.

Before you enable elevation, write the operating rules:

• Who can grant elevation, and for which scopes
• The maximum duration any grant may last
• What gets logged: requester, approver, reason, resources, start, and end
• What happens when the timer ends: permissions drop immediately, and the smaller day-to-day role is what remains

Admin as a job title grows. Admin as a short, explained, expiring event stays reviewable.