> ## Documentation Index > Fetch the complete documentation index at: https://docs.forge.ai/llms.txt > Use this file to discover all available pages before exploring further. # JIT Viewing > Require temporary approval before users can view sensitive session content. JIT Viewing keeps sensitive session content locked until a reviewer receives temporary, session-specific access. Session metadata remains available so operators can identify and triage activity without automatically exposing prompts, responses, tool payloads, or replay content. ## How it works When JIT Viewing is enabled: 1. Users can open a session and review its metadata, status, user, device, agent, timing, and related security records. 2. Sensitive content in Telemetry and Replay remains locked. 3. A user selects **Request access**, provides a justification, and chooses an access duration. 4. An assigned owner or a policy manager reviews the request through the Responses workflow. 5. Approval creates a temporary grant for that requester and that session only. 6. The grant expires automatically and the content becomes locked again. A grant cannot be used by another user or for another session. ## Enable JIT Viewing 1. Open **Settings**. 2. Select **Ownership**. 3. Turn on **Require approval for session content**. Organization administrators can change this setting. Users must already have permission to view session telemetry before they can request sensitive content access. ## Route requests to owners JIT Viewing uses the standard Responses ownership workflow. When the session user is linked to a directory group, Forge looks for an active owner assignment for that group. To route requests to a specific team: 1. Open **Settings**. 2. Select **Ownership**. 3. Add an owner for the directory group whose requests the team should review. 4. Choose Slack channel, Slack direct message, or email notifications as needed. Without a notification method, requests remain available in the Console. Matched requests appear in the owners' assigned response queues. If no owner matches, the request remains available in the full Responses queue for members with policy-management access. Owner assignment distributes review work without changing the requester's role or granting permanent access to session content. ## Request access Open a session with locked content and select **Request access** from Telemetry or Replay. Every request requires: * A justification. * A requested duration. * Approval before content is unlocked. The Console offers durations of 15 minutes, 30 minutes, 1 hour, and 4 hours. The API accepts bounded durations from 5 minutes through 24 hours. Submitting the same request again while it is pending does not create duplicate active requests. ## What remains visible JIT Viewing locks sensitive content rather than hiding the entire session. | Available while locked | Requires temporary access | | ------------------------------ | ------------------------- | | Session identity and timing | Prompts and responses | | User, device, and AI product | Tool inputs and results | | Status and event counts | Detailed event summaries | | Privacy and source state | Raw retained content | | Related findings and responses | Conversation Replay | Fields that were never collected or retained remain unavailable after access is approved. ## Grant lifecycle An approved grant is bound to: * The requesting Console user. * The selected session. * The approved expiration time. Expired, revoked, mismatched, or unscoped grants do not unlock content. Approval does not change the user's permanent organization role. ## Audit trail Forge records the JIT Viewing lifecycle in the organization Audit Log, including: * Changes to the organization setting. * The access request, requester, session, and requested duration. * Approval or rejection through the Responses workflow. * The temporary grant and expiration. * Access to unlocked Telemetry or Replay content. Audit records identify the grant and viewed surface without copying sensitive session content into the audit event. ## Related pages Review session metadata, Telemetry, and Replay. Control who can view telemetry, manage policies, and administer settings. Route temporary access requests to the appropriate people and teams. Review assigned and organization-wide governance requests. Inspect access requests, decisions, grants, and viewed surfaces.