Skip to content
Requesting Access from an Assistant

Requesting Access from an Assistant

Overview

Once your client is connected, you ask for access in plain language. You do not need profile IDs, environment IDs, or tool names — the assistant looks up your access first and matches from there. A checkout made this way is the same time-bound, audited checkout you would make in the console, so approvals, step-up MFA, and expiry all still apply.

What you’ll learn:

  • How to phrase requests for access, credentials, and secrets
  • How to supply a justification when a profile requires approval
  • How to supply a one-time passcode for step-up authentication
  • How to check in access when you are done

Before You Begin

  • An MCP client connected and signed in — see Getting Started
  • At least one profile or resource available for checkout — ask the assistant What Britive profiles can I check out?

Note: Britive grants two kinds of access and the assistant picks between them for you. Cloud and SaaS profiles — AWS, Azure, GCP, Okta, Snowflake, Salesforce — come from My Access. Servers, databases, Google Workspace, and other brokered targets come from My Resources. Name what you want and the assistant finds it.

Ask for What You Need

To do thisSay something like
See your accessWhat Britive profiles can I check out?
Check out accessCheck out my AWS read-only profile.
Get usable credentialsCheck out AWS read-only and give me programmatic credentials.
See what is currently outWhat do I have checked out right now?
Read a secretShow me the database password secret.
Release accessI’m done — check that back in.

Console access is the default. Unless you mention programmatic access, you get a console checkout — say “programmatic credentials” or “I need to use the CLI” if you want keys.

Anything the assistant returns — a secret value, a set of credentials — is now in your chat history, subject to that assistant’s retention. For credentials headed into a script, an environment variable, or a tool like DBeaver, use PyBritive instead. It writes credentials into your environment rather than a transcript.

Supply What the Assistant Asks For

A checkout through MCP never blocks — a conversation cannot sit still waiting on an approver. Instead of hanging, the assistant comes back to you.

Give a justification

If the profile requires approval, the assistant asks why you need the access before it submits anything.

Give a real reason. It goes to your approver and into the audit record — it is what they read when deciding. The assistant is instructed to ask you rather than write one on your behalf.

Give a one-time passcode

If the profile requires step-up authentication, the assistant asks for the current code from your authenticator app.

If it reports the code was rejected, it usually expired while being typed. Wait for a fresh one and give it that.

Wait briefly, if asked

Two waits are normal. Waiting on an approver means the request was submitted and the assistant checks back periodically — you can leave the conversation and return later, or watch for the outcome under My Requests in the console. Waiting on provisioning means access was granted but Britive is still creating the account or role behind it, which usually clears in seconds.

If an approver declines, the request expires, or it is withdrawn, access is not granted. Starting over means a new checkout with a fresh justification.

Check In When You Are Done

Access does not release itself before expiry.

Confirm what is out

What do I have checked out right now?

Check in

I’m finished with that access — check it in.

If several profiles are out, ask the assistant to check in all of them. It releases every one, not just the most recent.

Ask for the Least You Need

The assistant is instructed to try the task first and check out only when it actually hits a wall — and then to take the narrowest profile that would work. If read-only access does the job, it should not reach for an administrator profile. If you see it asking for more than the task needs, say so; it will take the correction.

Verify

Confirm the full round trip worked — access granted, then released.

Ask the assistant what you have checked out:

What do I have checked out right now?

After a checkout it names the profile and its expiry. After a check-in the profile is gone from that list.

Confirm the same in the console under My Access: the profile shows as checked out while your session is live, and returns to available once you check in.

Troubleshoot

SymptomCauseFix
Assistant says it cannot do something administrativeYour identity is not authorized for it, so the tool is not offeredExpected — check the action required in Tool Reference
Checkout stays in provisioning for minutesThe target platform is slow or misconfigured, not MCPCheck the transaction under My Access in the console
Approval never resolvesNo approver assigned, or no notification medium configuredCheck My Requests in the console, then ask your administrator
One-time passcode rejected repeatedlyCode expiring before it is submittedWait for a fresh code and give the assistant that one
Assistant reports success but nothing happenedWorth verifying rather than assumingAsk it to list your checked-out access, or check the console
Credentials returned but unusableConsole checkout when you needed programmaticAsk again for programmatic credentials

Next Steps

Last updated on