42 Scripted JIT admin elevation

Caveats

• Google has no native TTL on role assignments — the timer is your code, and its failure mode is silent standing access, so a failed revoke must page loudly rather than retry quietly.
• An already-issued admin session survives role revocation until it expires — pair JIT with cloud and web session control (№40, №12) or the elevation window is longer than the timer claims.
• The JIT service account becomes the crown jewel — it holds the power to grant roles permanently, so it needs the same custody treatment as the break-glass credential.

Setup steps

1. 1. Create the narrow custom role the JIT script will hand out — never Super Admin. Grant only the privileges the task needs.
   open ↗

   

   https://admin.google.com/ac/list/roles · captured 2026-07-15

   Account › Admin roles

   Custom role, e.g. 'JIT-UserMgmt' with Users > Update + Read only

2. 2. Strip the standing grant so there is nothing to steal between elevations.
   open ↗

   

   https://admin.google.com/ac/users · captured 2026-07-15

   gam print admins user <admin>   # note the roleAssignmentId
   gam delete admin <roleAssignmentId>

3. 3. Script the elevation: grant the role, start a timer, revoke unconditionally when it fires (Apps Script time-based trigger, or GAM under cron).

   Directory API roleAssignments.insert → sleep(TTL) → roleAssignments.delete; TTL = 60 min, started only once the grant is confirmed active — a new role typically applies within minutes but can take up to 24 hours

4. 4. Make the revoke fail-safe: if the revoke call errors, alert loudly rather than retrying quietly — a stuck grant is a standing grant.

   on revoke failure → page the security mailbox

5. 5. Alert on any role assignment that did NOT come from the JIT service account — that is the signal that someone elevated out-of-band.
   open ↗

   

   https://admin.google.com/ac/sc/investigation · captured 2026-07-15

   Reporting › Audit and investigation › Admin log events

   Filter: Event = Assign role; Actor ≠ jit-service-account (advanced/negative filter conditions in activity rules need Enterprise Standard+, Education Plus, Frontline Plus, Cloud Identity Premium or Chrome Enterprise Premium)

Ongoing maintenance

• automatable: AI agent Weekly: review the elevation log — every grant should map to a ticket.
• requires a human Quarterly: drill the elevation script end to end so it still works when needed.

How to verify

1. Confirm no standing grants beyond the floor, then run one elevation cycle end to end (grant, use, auto-revoke) as a drill.

   gam print admins