HubSpot has redesigned its Just-In-Time Access (JITA) authorization system using a rule engine architecture to make access decisions more observable and explainable. The system evaluates temporary access requests through independent rules instead of embedded conditional logic, allowing engineers to inspect how individual policies contribute to access decisions and manage authorization requirements as they change.
HubSpot’s JITA system processes approximately 5,500 access requests per business day across a workforce of about 10,000 employees. The previous implementation relied on increasingly complex conditional logic as new access scenarios were introduced. While this approach supported existing requirements, engineers found it difficult to determine why a request was approved or denied and which individual checks contributed to processing latency.
The redesigned architecture introduces a rule engine where authorization policies are evaluated as independent rules organized through a directed acyclic graph (DAG). Each rule produces structured output containing evaluation results, execution timing, and metadata used to understand the authorization decision.
HubSpot engineers identified decision visibility as a key requirement during the redesign. The team described the challenge as moving beyond determining whether the authorization system worked to understanding the reasoning behind individual decisions.
