Lifecycle & Access Governance
Request Access
Request access for yourself or someone you can request for, and submit every item in one cart.
Completes when the approved privilege is granted in its target system.
https://mcp.avatier.com/mcp
Ask in Plain Language
Run Request Access from the AI Assistant You Already Use
Same policy, approvals and Justification as the web app, with identity verification first in Avabot and MCP. One completed access request = one Secure Outcome; failed attempts are never billed.
You: Request the Finance Share group for Sam Ortiz, starting Monday. Reason: new hire. Avatier: verify: passed · for: Sam Ortiz · start: Monday · request number: returned
Why it matters
Access Requests That Live in Email and Tickets Can't Keep an Audit Clean.
Every request needs the right privilege, the right person, the right dates and a reason an approver and an auditor can read.
What a request needs
A privilege found by search or browse, requested for yourself or someone you can request for, with a justification, a start date and an end date.
What goes wrong by hand
A manual process leaves access verification hard for managers, security professionals, and auditors to see.
Why it matters now
Without a governed request path, grandfathered access, orphaned accounts, and unnecessary access to critical systems can go unnoticed.
What per-seat pricing charges
Per-seat IAM charges for every licensed seat, whether anyone requests access this month or not. Pay Per Identity Action™ charges only for completed requests.
The Action
How Request Access Runs
On the web, requests for yourself and for others run through the same cart. In Avabot and MCP you verify, search, pick one privilege, name who it is for, give a reason and set the dates.
Verify in Avabot or MCP
Avabot and MCP only. Request Access starts with identity verification in the conversation, with the methods your policy already allows, such as Security Questions, Google Authenticator, PingID Push or Identity Challenge Card. A verification earlier in the same conversation carries over.
Identity Verification (Avabot and MCP)
Select Who It Is For
Pick the recipient by connector and search: yourself, or someone your Lifecycle Management authority lets you request for. That is checked when you submit.
Find the Access
Search by name, in icon, list or detail view, or Browse resources down to their privileges.
Fill in the Form
Open the item and enter a Justification, a Start (now or a date) and an End (no expiration or a date). A privilege that creates an account asks for a Provisioning password, and some have Additional information fields.
Add to Cart
Add the item to the Request Cart and repeat as needed. Roles can go into the same cart.
Submit All
Open the Request Cart and tap Submit all. The Results list shows each item's Request ID, and any item that fails stays in the cart. Each request then goes through the requested privilege's approval workflow.
Approval point
Available on Web, Mobile, Teams, Avabot chat and MCP.
Avabot chat and MCP require the current (.NET 10) Avatier server.
In Avabot chat and MCP, each request covers one privilege, and privileges that need a request form are refused: request those on the web.
Request Access on the web, mobile and Teams also needs the .NET 10 server. On the .NET 4.8 server, access is requested in the legacy Lifecycle Management console.
Secure Outcome
What Counts as Done
A Secure Outcome is a completed, verified, policy-compliant identity action. An access request completes when the approved privilege is granted in its target system, through its connector or a manual grant task. One completed access request = one Secure Outcome.
Evidence
- A Request ID for each cart item, shown in the Results list
- An activity-log entry for each request
- Request emails
Guardrails
Your Assistant Asks. Avatier Decides.
Verified First
Avatier verifies the person before sensitive changes, with the methods your policy already allows.
Acts as the Signed-In User
OAuth sign-in to your own tenant. No shared service account, no API key to manage.
Never Makes Up Values
The connector only sends what the person actually said, and asks when something is missing.
Every Request Recorded
Requests land in Request History, ready to review and export.
Pay Per Identity Action™
Pay per Completed Request
Pay per completed request. Failed attempts are never billed.
| Compared | Manual or Per-Seat IAM | Request Access, Pay Per Identity Action™ |
|---|---|---|
| What you pay for | Every licensed seat, whether it acts or not | Completed requests only |
| Failed attempts | No line between an attempt and a result | Attempts, failures and retries are never billed |
| Many items | One ticket or email per item | One Request Cart, one Submit all |
| The work | Manual intervention or tickets | Each item becomes its own request and is granted in its target system after approval |
| Evidence | Ad hoc, hard-to-produce evidence for reviews | A Request ID per item, an activity-log entry and request emails |
Pay Per Identity Action™ is in invitation-only preview. Pricing is shared with qualified organizations.
Works with the Systems Request Access Touches
Request Access grants each privilege in its target system, through that system's connector, such as Active Directory or Entra ID groups, LDAP or application entitlements, or through a manual grant task for privileges that people fulfil.
- LDAP
- Microsoft
- Active Directory and Entra ID groups, through their connectors.
- Other Systems
- LDAP and application entitlements through their connectors, or a manual grant task for privileges people fulfil by hand.
Avatier MCP
New to Avatier MCP?
The Model Context Protocol is an open standard, stewarded by the Linux Foundation, that lets AI assistants call real systems through connectors instead of custom integrations.
Up and Running in Under a Minute
One URL works in every MCP client. Pick yours, copy, paste, sign in.
Microsoft Copilot Studio
Claude Code
OpenAI Codex
Cursor
Frequently Asked Questions
Can I request several things at once?
Yes. Add privileges, and roles, to the Request Cart and tap Submit all. Each item gets its own Request ID and approval, and any that fail stay in the cart so you can retry.
Why can't Avabot request a particular privilege?
Privileges that need a request form can only be requested in the portal; Avabot refuses them.
Can I request access for someone else?
Yes, for people your Lifecycle Management authority lets you request for. Requests for anyone else are refused at submit ("You are not permitted to submit LC requests for the target user").
Does Avatier provide AI-driven compliance reporting?
Yes. Avatier turns continuous identity and access data into audit-ready reports on demand, using AI to assemble who has access to what, what changed, and who approved it, mapped to the controls auditors expect. Instead of a manual evidence scramble before each audit, you generate plain-language, exportable reports covering SOC 2 Type II and ISO 27001, plus the evidence needs associated with NIST, SOX, HIPAA, and GDPR.
What is AI-driven configuration?
Avatier's AI-driven config turns plain-language intent into working policy. Rather than hand-coding rules, connectors, and roles, administrators describe what they need and Avatier recommends and sets up provisioning rules, role mappings, and workflows, then validates them before they go live. It shortens deployment from months to days and keeps configuration consistent, auditable, and free of custom scripting.
What is Pay Per Identity Action™?
Pay Per Identity Action™ is Avatier's pricing mechanic. Customers pay only for completed, verified, policy-compliant identity actions, called Secure Outcomes.
Is it the same as pay-per-action advertising?
No. Pay per action (PPA) is performance-marketing vocabulary for paying when an ad converts. Pay Per Identity Action™ charges for completed identity work.
How do I get started?
Getting started is free, deployment services are included, and a 45-day money-back guarantee applies. Contact Avatier for pricing for your organization.
What is MCP?
The Model Context Protocol is an open standard, stewarded by the Linux Foundation, that lets AI assistants call real systems through connectors instead of custom integrations.
How is it billed?
Pay Per Identity Action™ is in invitation-only preview: each completed, verified action is one Secure Outcome, and attempts, failures and retries are never billed.
Request Access
Every Request, with a Request ID.
Search or browse privileges, request them for yourself or someone you can request for, and submit the whole cart at once.