JIT Viewing

JIT Viewing keeps sensitive session content locked until a reviewer receives temporary, session-specific access. Session metadata remains available so operators can identify and triage activity without automatically exposing prompts, responses, tool payloads, or replay content.

​

How it works

When JIT Viewing is enabled:

1. Users can open a session and review its metadata, status, user, device, agent, timing, and related security records.
2. Sensitive content in Telemetry and Replay remains locked.
3. A user selects Request access, provides a justification, and chooses an access duration.
4. An assigned owner or a policy manager reviews the request through the Responses workflow.
5. Approval creates a temporary grant for that requester and that session only.
6. The grant expires automatically and the content becomes locked again.

A grant cannot be used by another user or for another session.

​

Enable JIT Viewing

1. Open Settings.
2. Select Ownership.
3. Turn on Require approval for session content.

Organization administrators can change this setting. Users must already have permission to view session telemetry before they can request sensitive content access.

​

Route requests to owners

JIT Viewing uses the standard Responses ownership workflow. When the session user is linked to a directory group, Forge looks for an active owner assignment for that group. To route requests to a specific team:

1. Open Settings.
2. Select Ownership.
3. Add an owner for the directory group whose requests the team should review.
4. Choose Slack channel, Slack direct message, or email notifications as needed. Without a notification method, requests remain available in the Console.

Matched requests appear in the owners’ assigned response queues. If no owner matches, the request remains available in the full Responses queue for members with policy-management access. Owner assignment distributes review work without changing the requester’s role or granting permanent access to session content.

​

Request access

Open a session with locked content and select Request access from Telemetry or Replay. Every request requires:

• A justification.
• A requested duration.
• Approval before content is unlocked.

The Console offers durations of 15 minutes, 30 minutes, 1 hour, and 4 hours. The API accepts bounded durations from 5 minutes through 24 hours. Submitting the same request again while it is pending does not create duplicate active requests.

​

What remains visible

JIT Viewing locks sensitive content rather than hiding the entire session. Fields that were never collected or retained remain unavailable after access is approved.

​

Grant lifecycle

An approved grant is bound to:

• The requesting Console user.
• The selected session.
• The approved expiration time.

Expired, revoked, mismatched, or unscoped grants do not unlock content. Approval does not change the user’s permanent organization role.

​

Audit trail

Forge records the JIT Viewing lifecycle in the organization Audit Log, including:

• Changes to the organization setting.
• The access request, requester, session, and requested duration.
• Approval or rejection through the Responses workflow.
• The temporary grant and expiration.
• Access to unlocked Telemetry or Replay content.

Audit records identify the grant and viewed surface without copying sensitive session content into the audit event.

​

Related pages