HubSpot Redesigns JITA Authorization with Rule Engine for Improved Observability

HubSpot Overhauls JITA Authorization

HubSpot has implemented a significant redesign of its Just-In-Time Access (JITA) authorization system. The previous system, which handled approximately 5,500 access requests per business day for around 10,000 employees, relied on increasingly complex conditional logic. This complexity made it difficult for engineers to understand the reasoning behind access decisions.

Rule Engine Architecture for Clarity

The core of the redesign is a new rule engine architecture. This system evaluates temporary access requests through independent rules, replacing the embedded conditional logic of the prior implementation. Authorization policies are now organized as independent rules within a directed acyclic graph (DAG).

Enhanced Observability and Explainability

A key driver for the redesign was the need for improved decision visibility. The new architecture allows engineers to inspect how individual policies contribute to access decisions. Each rule produces structured output detailing evaluation results, execution timing, and metadata, providing a clear explanation for every authorization decision. This also enables rule-level observability, allowing engineers to monitor individual rule execution times and outcomes.

Streamlined Data Handling

The architecture separates shared request data from individual authorization rules using a common context object. User attributes, team information, and request details are collected once and passed to rules during execution. This approach reduces redundant data retrieval and ensures consistent inputs across all authorization checks.