--- title: Approval Workflow for Server Access | daily.dev description: Teleport introduces a Workflow API that lets users request temporary elevated roles (like DBA or sudo-admin) with administrative approval, enforcing a 'two-man... canonical: https://daily.dev/posts/approval-workflow-for-server-access-ubnxa7m6m twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Approval Workflow for Server Access | daily.dev og:description: Teleport introduces a Workflow API that lets users request temporary elevated roles (like DBA or sudo-admin) with administrative approval, enforcing a 'two-man... og:url: https://daily.dev/posts/approval-workflow-for-server-access-ubnxa7m6m og:image: https://api.daily.dev/og/posts/uBnxa7M6M.png og:image:alt: Approval Workflow for Server Access og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Approval Workflow for Server Access **[Teleport](https://daily.dev/sources/teleport)** · 6 min read · 0 upvotes · 0 comments ## Summary Teleport introduces a Workflow API that lets users request temporary elevated roles (like DBA or sudo-admin) with administrative approval, enforcing a 'two-man rule' and full audit logging. The feature builds on Teleport's RBAC system, using tsh to request roles and tctl to approve them, and is aimed at reducing standing access to production infrastructure in line with Zero Trust principles. Upcoming plugins for Jira and Slack will integrate role escalation into existing workflows. Role escalation is available to enterprise users. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How does Teleport's Workflow API let users request temporary elevated access to servers? A Teleport user runs a command like tsh login with a --request-roles flag (for example, --request-roles=dba) to request an elevated role, which creates a pending request with a unique ID. An administrator then reviews pending requests with tctl request ls and approves one with tctl request approve, after which the requester receives an updated access certificate granting time-limited access, all recorded in an audit log. _Teams designing least-privilege access controls can track infrastructure tooling changes like this on daily.dev._ ### What is the two-man rule in the context of server access control? The two-man rule is a control mechanism where one person requests elevated access or permissions and a second person must approve the request before it takes effect, creating accountability and an audit trail. Teleport implements this through its Workflow API, where a user like Bob requests a role such as DBA and an administrator like Alice must approve it via tctl before access is granted. _Developers weighing access-control patterns for production systems can follow this kind of security tooling on daily.dev._ ## Similar posts on daily.dev - [What’s your go-to strategy for giving engineers access to production?](https://daily.dev/posts/what-s-your-go-to-strategy-for-giving-engineers-access-to-production--du8mxikvs) · Lobsters · 1 upvotes · 0 comments --- Tags: [#ssh](https://daily.dev/tags/ssh) [View this post on daily.dev](https://daily.dev/posts/approval-workflow-for-server-access-ubnxa7m6m) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Approval Workflow for Server Access","url":"https://daily.dev/posts/approval-workflow-for-server-access-ubnxa7m6m","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/approval-workflow-for-server-access-ubnxa7m6m"},"datePublished":"2026-08-23T12:22:03.004Z","dateModified":"2026-08-23T12:49:17.642Z","description":"Teleport introduces a Workflow API that lets users request temporary elevated roles (like DBA or sudo-admin) with administrative approval, enforcing a 'two-man...","image":"https://media.daily.dev/image/upload/s--foaA6JGU--/f_auto/v1722860399/public/Placeholder%2004","thumbnailUrl":"https://media.daily.dev/image/upload/s--foaA6JGU--/f_auto/v1722860399/public/Placeholder%2004","isAccessibleForFree":true,"articleSection":"Teleport","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Teleport","logo":"https://media.daily.dev/image/upload/s--Dw-Bbw6O--/c_limit,w_256/f_auto,q_auto/v1787487494/logos/teleport?_a=BAMAMicg0","url":"https://daily.dev/sources/teleport"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/approval-workflow-for-server-access-ubnxa7m6m","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"ssh","timeRequired":"PT6M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Teleport","item":"https://daily.dev/sources/teleport"},{"@type":"ListItem","position":3,"name":"Approval Workflow for Server Access"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/approval-workflow-for-server-access-ubnxa7m6m#faq","mainEntity":[{"@type":"Question","name":"How does Teleport's Workflow API let users request temporary elevated access to servers?","acceptedAnswer":{"@type":"Answer","text":"A Teleport user runs a command like tsh login with a --request-roles flag (for example, --request-roles=dba) to request an elevated role, which creates a pending request with a unique ID. An administrator then reviews pending requests with tctl request ls and approves one with tctl request approve, after which the requester receives an updated access certificate granting time-limited access, all recorded in an audit log. Teams designing least-privilege access controls can track infrastructure tooling changes like this on daily.dev."}},{"@type":"Question","name":"What is the two-man rule in the context of server access control?","acceptedAnswer":{"@type":"Answer","text":"The two-man rule is a control mechanism where one person requests elevated access or permissions and a second person must approve the request before it takes effect, creating accountability and an audit trail. Teleport implements this through its Workflow API, where a user like Bob requests a role such as DBA and an administrator like Alice must approve it via tctl before access is granted. Developers weighing access-control patterns for production systems can follow this kind of security tooling on daily.dev."}}]} ```