HubSpot has redesigned its Just-In-Time Access (JITA) authorization system using a rule engine architecture to make access decisions more observable and explainable. The system evaluates temporary access requests through independent rules instead of embedded conditional logic, allowing engineers to inspect how individual policies contribute to access decisions and manage authorization requirements as they change.
HubSpot’s JITA system processes approximately 5,500 access requests per business day across a workforce of about 10,000 employees. The previous implementation relied on increasingly complex conditional logic as new access scenarios were introduced. While this approach supported existing requirements, engineers found it difficult to determine why a request was approved or denied and which individual checks contributed to processing latency.
The redesigned architecture introduces a rule engine where authorization policies are evaluated as independent rules organized through a directed acyclic graph (DAG). Each rule produces structured output containing evaluation results, execution timing, and metadata used to understand the authorization decision.
Simplified DAG showing role-based branching and parallel rule evaluation (Source: HubSpot Blog Post)
HubSpot engineers identified decision visibility as a key requirement during the redesign. The team described the challenge as moving beyond determining whether the authorization system worked to understanding the reasoning behind individual decisions.
The question wasn't just does this work?
It was Can we explain every decision this system makes, to anyone, at any time?
The architecture separates shared request data from individual authorization rules through a common context object. User attributes, team information, and request details are collected before evaluation and passed to rules during execution. This approach reduces duplicate data retrieval and provides consistent inputs across authorization checks.
The system also introduces observability at the rule level. Instead of measuring only the overall authorization request, engineers can inspect individual rule execution times, failures, and outcomes. This provides visibility into slow evaluations and the contribution of specific policies to authorization processing.
HubSpot uses isolated rule execution to handle failures during evaluation. If a rule encounters an error because of an unavailable dependency or unexpected condition, the failure is recorded while other rules continue evaluation. Access decisions continue to rely on the results defined by authorization rules.
The migration process included running the legacy and new authorization systems in parallel and comparing decisions before routing production authorization requests through the new implementation. The team also introduced periodic reviews involving security, product, and operational stakeholders to evaluate whether rules remain appropriately scoped and aligned with access requirements.
Recertification dashboard showing usage metrics and execution statistics per rule (Source: HubSpot Blog Post)
Similar approaches have emerged across the industry, although implementations vary based on the type of access being managed. Open Policy Agent (OPA) provides a policy-as-code model that separates authorization decisions from application logic through a dedicated policy engine. Google Cloud’s Privileged Access Manager focuses on temporary activation of privileged cloud permissions with approval workflows and audit tracking. Microsoft Entra Privileged Identity Management similarly manages just-in-time activation of privileged roles. These systems emphasize declarative policies or identity governance, while HubSpot’s implementation focuses on application-specific access workflows with rule-level execution visibility.
By introducing a rule engine, structured decision metadata, and governance processes, HubSpot has moved JITA authorization from embedded conditional logic toward a system where access decisions can be evaluated, monitored, and reviewed over time.