ACcessSherpa: AI JML Copilot

JML on autopilot: propose, approve, provision

Comment

Inspiration

I spend a lot of time untangling onboarding/offboarding tickets across AD, GitHub, AWS, and Slack. It’s repetitive, high-risk, and easy to miss something during handovers. I wanted a copilot that proposes the right access up front, automates the plumbing, and leaves an audit trail managers and auditors actually trust.

What it does

Listens to HR/IT signals (webhook or chat command) and generates a Joiner–Mover–Leaver plan. Proposes least-privilege entitlements from role + peer patterns. Runs policies (SoD, approvals, time-boxed elevation) with OPA/Rego. Executes across Entra ID/AD, AWS IAM Identity Center, GitHub, Slack. Produces diffs, dry-runs, and tamper-evident audit logs. Chat UX: “/onboard Sofía Senior DevOps 2025-10-01” → preview → one click approve.

How we built it

Stack: FastAPI + Celery, Postgres (identity graph), Redis (queue/cache). Connectors: Microsoft Graph (users, groups, licenses), AWS SSO/SCIM (permission sets), GitHub (org/teams), Slack (modals/approvals). Policy layer: OPA sidecar with Rego bundles for required groups, SoD, time limits. Recommendation engine: k-NN over peer entitlements + rule weighting → candidate set ranked by risk. Infra: Docker, Terraform on AWS (ECS Fargate, RDS Postgres, Secrets Manager, CloudWatch logs). Security: Least-privileged service principals, signed webhooks, KMS-encrypted secrets, append-only audit store.

Challenges we ran into

Entitlement sprawl: Normalizing “same thing, different name” across systems took work (mappings + tags). Idempotency: Ensuring replays don’t over-grant—solved with resource fingerprints and action guards. Approvals UX: Managers hate JSON—built Slack modals with human-readable diffs and risk badges. SCIM quirks: Provider differences around delete/disable semantics—added per-connector adapters + tests. SoD edge cases: Temporary elevations that overlap reviews—added auto-revoke timers and reminders.

Accomplishments that we're proud of

From ticket to access in <10 min for standard roles (was hours/days). Zero drift on pilot teams after weekly reconciliation jobs. One-click offboarding that also transfers GitHub ownership and revokes AWS roles. Audit pack export: CSV + PDF with who/what/when/why, signed hash for integrity.

What we learned

Most “policy” lived in people’s heads—codifying it in Rego surfaced contradictions early. Recommendations are trusted only when they’re explainable (peer set, last activity, policy references). Dry-runs + reversible actions dramatically increase adoption. Chat is the right control plane, but clear diffs and timeouts are essential to avoid rubber-stamping.

What's next for ACcessSherpa: AI JML Copilot

Add Google Workspace, Okta, Jira/Confluence, Datadog connectors. Quarterly access recertification flows with manager attestations. License reclamation for inactive users to cut SaaS spend. Fine-grained AWS Just-In-Time elevation with automatic CloudTrail evidence. Hardening: SOC2-friendly controls, customer-managed KMS keys, and per-tenant isolation.

Built With

Share this project:

Updates

Submission history