Admin when the task needs it, then back

Choose who may ask

Under Access in the workspace sidebar, an owner or admin makes a developer or viewer eligible and sets their cap: the longest window they may ask for, from 15 minutes to 8 hours. Making someone eligible or changing their cap needs an approval.

tilldev access eligible add ana@acme.dev --max 120          # an owner or admin approves each request
tilldev access eligible add oncall@acme.dev --max 60 --approval self   # starts at once (owners only)
tilldev access eligible                                    # who may ask
tilldev access eligible rm ana@acme.dev                    # also ends anything open

Owners and admins already hold admin, so they aren’t offered it. Nobody can ask for owner.

Ask for admin

A request names how many minutes (up to your cap), a reason of at least 10 characters and, if you like, a ticket reference. Asking needs an approval with your passkey, phone or confirmed authenticator code, so someone holding only your session can’t ask on your behalf. You can have one request waiting or one window running at a time.

$ tilldev access elevate --reason "rotate the prod database key" --minutes 30 --ticket INC-4411 --wait
* Waiting for an owner or admin to approve… https://tilldev.dev/acme/access
OK Admin for 30 minutes, until 2026-10-05T12:30:00.000Z

$ tilldev access                 # your role, your cap, anything open
$ tilldev access end             # end it early, or withdraw a request still waiting

Owners and admins get an email and a notification in the dashboard. A request nobody decides within 60 minutes lapses. With --wait, the CLI waits for the decision and then renews your sign-in so the next command runs as admin. Without it, run tilldev access refresh after it’s approved. In the dashboard, the page picks it up by itself and a banner shows the time left.

Approve or reject

Only a standing owner or admin can decide, never the person who asked, and never someone who holds admin only through their own elevation. Approving needs an approval of its own. The window starts when it’s approved, so time spent waiting doesn’t count against it.

tilldev access ls --all --status pending
tilldev access approve 5b0c… --note "ok for INC-4411"
tilldev access reject 5b0c… --note "use the runbook instead"
tilldev access end 5b0c…          # end someone's running window

What it covers, and what it doesn’t

While the window is open, the person’s dashboard and CLI sessions act as an admin across the workspace. Some things stay with standing owners and admins, so an elevation can’t make itself permanent or wave itself through:

• granting, changing or removing the admin role, and inviting admins;
• changing who may ask for admin;
• approving or rejecting anyone’s request;
• turning approvals off for the workspace;
• changing company sign-in.

API keys, service tokens and agent tokens never elevate; they keep their own role. A resource-level grant that limits someone to certain projects still limits them while elevated.

How a window ends

The session drops back to its standing role on its next request after the window ends, and other servers stop honouring it within seconds. Nothing has to be revoked by hand.

The requester or any owner or admin can end a window early from the Access page or with tilldev access end. A TillShield playbook that signs someone out of the workspace ends their window too.

The record

Every request, approval, rejection, start, ending, withdrawal, lapse and eligibility change is in the workspace audit log and the security event stream, with the reason, ticket and who decided. The Access page keeps the history.

From the API

The endpoints are under Access in the API reference. They take a signed-in session; an API key gets 401.

# Ask (needs an approval, like other sensitive actions)
curl -s -X POST https://tilldev.dev/api/access/elevations \
  -H "authorization: Bearer $SESSION" -H "content-type: application/json" \
  -d '{"reason":"rotate the prod database key","minutes":30,"ticket":"INC-4411"}'

# Once it is active, refresh the session so it carries the admin role
curl -s -X POST https://tilldev.dev/api/auth/refresh -H "authorization: Bearer $REFRESH" -H "x-token-in-body: 1"