# Building Observable Access Control at Scale: A Rule Engine Approach to JITA

DevFeed: [Building Observable Access Control at Scale: A Rule Engine Approach to JITA](<https://devfeed.tech/articles/building-observable-access-control-at-scale-a-rule-engine-approach-to-jita-29101.md>)

Original publisher: [Read original article](<https://product.hubspot.com/blog/building-observable-access-control-at-scale-a-rule-engine-approach-to-jita>)

Author: ankeith@hubspot.com (Andrew Keith)

Published: 2026-06-30T18:30:42Z

Content type: article

Language: en

Sources: [HubSpot](<https://devfeed.tech/sources/hubspot.md>)

Topics: [Access Control](<https://devfeed.tech/topics/access-control.md>), [hubspot](<https://devfeed.tech/topics/hubspot.md>), [Authorization](<https://devfeed.tech/topics/authorization.md>), [observability](<https://devfeed.tech/topics/observability.md>), [Security](<https://devfeed.tech/topics/security.md>)

Tags: [access-control](<https://devfeed.tech/tags/access-control.md>), [business](<https://devfeed.tech/tags/business.md>), [customer](<https://devfeed.tech/tags/customer.md>), [customer-trust](<https://devfeed.tech/tags/customer-trust.md>), [data](<https://devfeed.tech/tags/data.md>), [engineering](<https://devfeed.tech/tags/engineering.md>), [logging](<https://devfeed.tech/tags/logging.md>), [metrics](<https://devfeed.tech/tags/metrics.md>), [observability](<https://devfeed.tech/tags/observability.md>), [security](<https://devfeed.tech/tags/security.md>)

## AI overview

HubSpot describes the challenges of managing Just-In-Time Access requests at scale. The article explains how a growing collection of nested conditionals made access decisions difficult to audit and maintain, creating a need for observable, rule-based access control.

## Source excerpt

The Problem At HubSpot, we have a fundamental tension built into our culture: we want to help customers succeed, which often means giving employees access to customer portals: Engineers to fix bugs, sales engineers assisting with account setup, or customer support troubleshooting issues during live support calls. But we also need to completely lock down customer data -- because a breach or misuse doesn't just violate customer trust, it can expose sensitive business data, create legal liability, and cause reputational damage that's hard to recover from. Access must be granted only for legitimate, verifiable, and auditable reasons.