HubSpot has overhauled its Just-In-Time Access authorization system to make access decisions easier to understand and trace, according to a recent engineering report published on InfoQ. The company replaced embedded conditional logic with a rule engine architecture that evaluates temporary access requests through independent rules, allowing engineers to see how individual policies shape each decision. The system now processes roughly 5,500 access requests every business day for a workforce of around 10,000 employees.
The earlier version of HubSpot's JITA system grew harder to manage as new access scenarios piled up, creating increasingly tangled conditional logic. Engineers struggled to pinpoint why a given request succeeded or failed and couldn't identify which individual checks slowed down processing. The redesigned platform organizes authorization policies as standalone rules arranged in a directed acyclic graph, with each rule producing structured output that includes evaluation results, execution timing, and metadata. This setup separates shared request data—such as user attributes, team information, and request details—from individual authorization rules through a common context object, cutting down on duplicate data retrieval and delivering consistent inputs across checks.
The engineering team framed decision visibility as a central goal during the redesign. According to the report, the challenge shifted from simply asking "does this work?" to asking "Can we explain every decision this system makes, to anyone, at any time?" The new architecture also brings observability down to the rule level, letting engineers inspect individual rule execution times, failures, and outcomes instead of measuring only the overall authorization request. HubSpot uses isolated rule execution to handle failures: if a rule hits an error due to an unavailable dependency or unexpected condition, the failure is logged while other rules keep running. Before routing production authorization requests through the new implementation, the team ran the legacy and new systems side by side and compared decisions, and it introduced periodic reviews with security, product, and operational stakeholders to check whether rules stay appropriately scoped.
HubSpot's approach fits within a broader industry trend toward separating authorization decisions from application logic, though implementations differ based on the type of access being managed. Open Policy Agent offers a policy-as-code model with a dedicated policy engine, while Google Cloud's Privileged Access Manager and Microsoft Entra Privileged Identity Management handle temporary activation of privileged roles with approval workflows and audit tracking. Those systems lean on declarative policies or identity governance, whereas HubSpot's implementation centers on application-specific access workflows with rule-level execution visibility. The shift lets HubSpot evaluate, monitor, and review access decisions over time rather than rely on embedded conditional logic that obscures how individual policies contribute.
By introducing a rule engine, structured decision metadata, and governance processes, HubSpot has transformed its JITA authorization into a system where every access decision can be traced, understood, and refined. The company's engineering report suggests this architecture will support changing authorization requirements without sacrificing clarity, giving teams the visibility they need to keep access policies aligned with security and operational needs as the organization grows.