40 Scripted JIT admin elevation

Standing admin privilege is privilege an attacker can steal at any moment. JIT elevation strips the standing grant and hands the role out on request from a script that starts a timer and revokes unconditionally when it fires — a Directory API role assignment plus an Apps Script trigger or GAM under cron. What is handed out is a narrow custom role, never Super Admin, and any role assignment that did not come from the JIT service account is itself an alert.

Documentation: Manage roles ↗

Caveats

Google has no native TTL on role assignments¹
An already-issued admin session survives role revocation until it expires²
The JIT service account becomes the crown jewel³

Setup steps

open ↗
https://admin.google.com/ac/list/roles · captured 2026-07-15
Account › Admin roles
Create the narrow custom role the JIT script will hand out — never Super Admin. Grant only the privileges the task needs.

Custom role, e.g. 'JIT-UserMgmt' with Users > Update + Read only

Create, edit, and delete custom admin roles ↗
open ↗
https://admin.google.com/ac/users · captured 2026-07-15

Strip the standing grant so there is nothing to steal between elevations.
```
gam print admins user <admin>   # note the roleAssignmentId
gam delete admin <roleAssignmentId>
```
Remove Google Workspace administrator privileges ↗
Script the elevation: grant the role, start a timer, revoke unconditionally when it fires (Apps Script time-based trigger, or GAM under cron).

Directory API roleAssignments.insert → sleep(TTL) → roleAssignments.delete; TTL = 60 min, started only once the grant is confirmed active — a new role typically applies within minutes but can take up to 24 hours

REST Resource: roleAssignments ↗ Installable Triggers ↗
Make the revoke fail-safe: if the revoke call errors, alert loudly rather than retrying quietly — a stuck grant is a standing grant.

on revoke failure → page the security mailbox
open ↗
https://admin.google.com/ac/sc/investigation · captured 2026-07-15
Reporting › Audit and investigation › Admin log events
Alert on any role assignment that did NOT come from the JIT service account — that is the signal that someone elevated out-of-band.

Filter: Event = Assign role; Actor ≠ jit-service-account (advanced/negative filter conditions in activity rules need Enterprise Standard+, Education Plus, Frontline Plus, Cloud Identity Premium or Chrome Enterprise Premium)

Admin log events ↗ Create and manage activity rules ↗

Ongoing maintenance

automatable: AI agent Weekly: review the elevation log — every grant should map to a ticket.
requires a human Quarterly: drill the elevation script end to end so it still works when needed.

How to verify

Confirm no standing grants beyond the floor, then run one elevation cycle end to end (grant, use, auto-revoke) as a drill.
```
gam print admins
```

v0.1.3Prevent policy #29 · #4, #32 ↗