Lifecycle & Access Governance
Proxy My Authority
Lend your approval authority to someone for a set period, so requests keep moving while you're away.
Completes when the proxy is saved with its start and end dates.
https://mcp.avatier.com/mcp
Ask in Plain Language
Run Proxy My Authority from the AI Assistant You Already Use
No approval and no justification: proxies are saved straight away, with identity verification first in Avabot and MCP. One completed delegation = one Secure Outcome; failed attempts are never billed.
You: Give Jamie Park my approval authority from 3 November to 14 November. Avatier: verify: passed · proxy: Jamie Park · window: 3 to 14 November · status: saved
Why it matters
Approvals Shouldn't Stop When the Approver Is Away.
Time off and travel leave requests waiting, unless someone else can approve them for a set period.
What a delegation needs
One or more people to approve on your behalf, a start date and an end date.
What goes wrong by hand
Without a proxy, requests wait until you are back, or someone edits workflows by hand and has to remember to change them back.
What Proxy My Authority does
Each proxy is saved with its start and end dates, every add and removal is written to the activity log, and expired proxies drop off the list.
What per-seat pricing charges
Per-seat IAM charges for every licensed seat, whether anyone delegates authority this month or not. Pay Per Identity Action™ charges only for completed delegations.
The Action
How Proxy My Authority Runs
On the web, Proxy My Authority walks through these screens. In Avabot and MCP you verify, then grant your authority for a start and end window, review who holds it, or cancel a grant.
Verify in Avabot or MCP
Avabot and MCP only. Proxy My Authority starts with identity verification in the conversation, with the methods your policy already allows. On the web there is no extra check beyond your sign-in. Proxy My Authority is high-risk, so by default it starts only if you verified in the last 5 minutes; otherwise you verify again.
Identity Verification (Avabot and MCP)
Open Your Proxies
Open Proxy My Authority to see current and future proxies, with search, date filters, sorting and export.
Pick the People
Choose Add, then on the Users tab search for and select one or more people. By default the picker is limited to your Lifecycle Management request scope. You can't proxy to yourself, and proxying to your own direct report shows a warning.
Set the Dates
On the Date tab set the Proxy Start Date and Proxy End Date. The start must be before the end.
Save
On the Result tab review and Save; each person shows success or a reason. To revoke, choose Edit, select proxies and Remove.
Available on Web, Mobile, Teams, Avabot chat and MCP.
Avabot chat and MCP require the current (.NET 10) Avatier server.
In Avabot chat and MCP, you manage your own authority only: grant, review or cancel, with no export and no managing other people's proxies.
Secure Outcome
What Counts as Done
A Secure Outcome is a completed, verified, policy-compliant identity action. A delegation completes when it is saved: each new proxy is stored with its start and end dates, and an activity-log entry is written for every add and removal. There is no approval and no request. One completed delegation = one Secure Outcome.
Evidence
- An activity-log entry for every proxy added or removed
- The list of current and future proxies (PDF or Excel export, on the web and mobile)
Guardrails
Your Assistant Asks. Avatier Decides.
Verified First
Avatier verifies the person before sensitive changes, with the methods your policy already allows.
Acts as the Signed-In User
OAuth sign-in to your own tenant. No shared service account, no API key to manage.
Never Makes Up Values
The connector only sends what the person actually said, and asks when something is missing.
Pay Per Identity Action™
Pay per Completed Delegation
Pay per completed delegation. Failed attempts are never billed.
| Compared | Manual or Per-Seat IAM | Proxy My Authority, Pay Per Identity Action™ |
|---|---|---|
| What you pay for | Every licensed seat, whether it acts or not | Completed delegations only |
| Failed attempts | No line between an attempt and a result | Attempts, failures and retries are never billed |
| The work | Manual intervention or tickets | Each proxy is saved with its start and end dates, with no approval needed |
| Evidence | Silent failures and missing audit trails | An activity-log entry for every add and removal, and an exportable proxy list |
Pay Per Identity Action™ is in invitation-only preview. Pricing is shared with qualified organizations.
Works with the Approvals Proxy My Authority Touches
Proxy My Authority changes who can approve Lifecycle Management requests on your behalf, in Avatier only. No directory account is changed.
- Lifecycle Management approvals
Avatier MCP
New to Avatier MCP?
The Model Context Protocol is an open standard, stewarded by the Linux Foundation, that lets AI assistants call real systems through connectors instead of custom integrations.
Up and Running in Under a Minute
One URL works in every MCP client. Pick yours, copy, paste, sign in.
Microsoft Copilot Studio
Claude Code
OpenAI Codex
Cursor
Frequently Asked Questions
Who can I choose as a proxy?
By default, people within your Lifecycle Management request scope. An admin can turn on unrestricted search, and workflow admins can always search everyone.
Can I proxy to my own direct report?
Yes, but you'll see a warning. Depending on your tenant's settings, the proxy may be prevented from approving their own requests.
Can an admin set up a proxy for someone who is out of office?
On the web, yes, when the tenant turns on "Assign Authority to Delegated Users" and the admin is in the group allowed to change proxy authority. Avabot only manages your own proxies.
Does Avatier provide AI-driven compliance reporting?
Yes. Avatier turns continuous identity and access data into audit-ready reports on demand, using AI to assemble who has access to what, what changed, and who approved it, mapped to the controls auditors expect. Instead of a manual evidence scramble before each audit, you generate plain-language, exportable reports covering SOC 2 Type II and ISO 27001, plus the evidence needs associated with NIST, SOX, HIPAA, and GDPR.
What is AI-driven configuration?
Avatier's AI-driven config turns plain-language intent into working policy. Rather than hand-coding rules, connectors, and roles, administrators describe what they need and Avatier recommends and sets up provisioning rules, role mappings, and workflows, then validates them before they go live. It shortens deployment from months to days and keeps configuration consistent, auditable, and free of custom scripting.
What is Pay Per Identity Action™?
Pay Per Identity Action™ is Avatier's pricing mechanic. Customers pay only for completed, verified, policy-compliant identity actions, called Secure Outcomes.
Is it the same as pay-per-action advertising?
No. Pay per action (PPA) is performance-marketing vocabulary for paying when an ad converts. Pay Per Identity Action™ charges for completed identity work.
How do I get started?
Getting started is free, deployment services are included, and a 45-day money-back guarantee applies. Contact Avatier for pricing for your organization.
What is MCP?
The Model Context Protocol is an open standard, stewarded by the Linux Foundation, that lets AI assistants call real systems through connectors instead of custom integrations.
How is it billed?
Pay Per Identity Action™ is in invitation-only preview: each completed, verified action is one Secure Outcome, and attempts, failures and retries are never billed.
Proxy My Authority
You've Automated the System. Now Secure the Approvals.
Pick who approves for you and for how long, and every proxy you add or remove is written to the activity log.