Requesting Access from an Assistant
Overview
Once your client is connected, you ask for access in plain language. You do not need profile IDs, environment IDs, or tool names — the assistant looks up your access first and matches from there. A checkout made this way is the same time-bound, audited checkout you would make in the console, so approvals, step-up MFA, and expiry all still apply.
What you’ll learn:
- How to phrase requests for access, credentials, and secrets
- How to supply a justification when a profile requires approval
- How to supply a one-time passcode for step-up authentication
- How to check in access when you are done
Before You Begin
- An MCP client connected and signed in — see Getting Started
- At least one profile or resource available for checkout — ask the assistant What Britive profiles can I check out?
Note: Britive grants two kinds of access and the assistant picks between them for you. Cloud and SaaS profiles — AWS, Azure, GCP, Okta, Snowflake, Salesforce — come from My Access. Servers, databases, Google Workspace, and other brokered targets come from My Resources. Name what you want and the assistant finds it.
Ask for What You Need
| To do this | Say something like |
|---|---|
| See your access | What Britive profiles can I check out? |
| Check out access | Check out my AWS read-only profile. |
| Get usable credentials | Check out AWS read-only and give me programmatic credentials. |
| See what is currently out | What do I have checked out right now? |
| Read a secret | Show me the database password secret. |
| Release access | I’m done — check that back in. |
Console access is the default. Unless you mention programmatic access, you get a console checkout — say “programmatic credentials” or “I need to use the CLI” if you want keys.
Anything the assistant returns — a secret value, a set of credentials — is now in your chat history, subject to that assistant’s retention. For credentials headed into a script, an environment variable, or a tool like DBeaver, use PyBritive instead. It writes credentials into your environment rather than a transcript.
Supply What the Assistant Asks For
A checkout through MCP never blocks — a conversation cannot sit still waiting on an approver. Instead of hanging, the assistant comes back to you.
Give a justification
If the profile requires approval, the assistant asks why you need the access before it submits anything.
Give a real reason. It goes to your approver and into the audit record — it is what they read when deciding. The assistant is instructed to ask you rather than write one on your behalf.
Give a one-time passcode
If the profile requires step-up authentication, the assistant asks for the current code from your authenticator app.
If it reports the code was rejected, it usually expired while being typed. Wait for a fresh one and give it that.
Wait briefly, if asked
Two waits are normal. Waiting on an approver means the request was submitted and the assistant checks back periodically — you can leave the conversation and return later, or watch for the outcome under My Requests in the console. Waiting on provisioning means access was granted but Britive is still creating the account or role behind it, which usually clears in seconds.
If an approver declines, the request expires, or it is withdrawn, access is not granted. Starting over means a new checkout with a fresh justification.
Check In When You Are Done
Access does not release itself before expiry.
Confirm what is out
What do I have checked out right now?
Check in
I’m finished with that access — check it in.
If several profiles are out, ask the assistant to check in all of them. It releases every one, not just the most recent.
Ask for the Least You Need
The assistant is instructed to try the task first and check out only when it actually hits a wall — and then to take the narrowest profile that would work. If read-only access does the job, it should not reach for an administrator profile. If you see it asking for more than the task needs, say so; it will take the correction.
Verify
Confirm the full round trip worked — access granted, then released.
Ask the assistant what you have checked out:
What do I have checked out right now?
After a checkout it names the profile and its expiry. After a check-in the profile is gone from that list.
Confirm the same in the console under My Access: the profile shows as checked out while your session is live, and returns to available once you check in.
Troubleshoot
| Symptom | Cause | Fix |
|---|---|---|
| Assistant says it cannot do something administrative | Your identity is not authorized for it, so the tool is not offered | Expected — check the action required in Tool Reference |
| Checkout stays in provisioning for minutes | The target platform is slow or misconfigured, not MCP | Check the transaction under My Access in the console |
| Approval never resolves | No approver assigned, or no notification medium configured | Check My Requests in the console, then ask your administrator |
| One-time passcode rejected repeatedly | Code expiring before it is submitted | Wait for a fresh code and give the assistant that one |
| Assistant reports success but nothing happened | Worth verifying rather than assuming | Ask it to list your checked-out access, or check the console |
| Credentials returned but unusable | Console checkout when you needed programmatic | Ask again for programmatic credentials |
Next Steps
- Tool Reference — every tool and the Britive action it requires
- PyBritive CLI — the same checkouts from your terminal