--- title: HubSpot Redesigns JITA Authorization with Rule Engine... description: HubSpot redesigned its Just-In-Time Access (JITA) authorization system by replacing complex conditional logic with a rule engine architecture. Authorization... canonical: https://daily.dev/posts/hubspot-redesigns-jita-authorization-with-rule-engine-architecture-7srnyocbs twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: HubSpot Redesigns JITA Authorization with Rule Engine Architecture | daily.dev og:description: HubSpot redesigned its Just-In-Time Access (JITA) authorization system by replacing complex conditional logic with a rule engine architecture. Authorization... og:url: https://daily.dev/posts/hubspot-redesigns-jita-authorization-with-rule-engine-architecture-7srnyocbs og:image: https://api.daily.dev/og/posts/7sRNYOCbs.png og:image:alt: HubSpot Redesigns JITA Authorization with Rule Engine Architecture og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # HubSpot Redesigns JITA Authorization with Rule Engine Architecture **[InfoQ](https://daily.dev/sources/infoq)** · 3 min read · 0 upvotes · 0 comments ## Summary HubSpot redesigned its Just-In-Time Access (JITA) authorization system by replacing complex conditional logic with a rule engine architecture. Authorization policies are now evaluated as independent rules organized in a directed acyclic graph (DAG), producing structured output with evaluation results, execution timing, and metadata. The system processes ~5,500 access requests per business day across ~10,000 employees. Key improvements include rule-level observability, isolated failure handling, a shared context object to reduce duplicate data retrieval, and governance workflows with periodic stakeholder reviews. The migration ran legacy and new systems in parallel before cutover. The approach is compared to Open Policy Agent, Google Cloud Privileged Access Manager, and Microsoft Entra PIM, with HubSpot's focus being application-specific workflows with fine-grained execution visibility. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Similar posts on daily.dev - [Just-in-Time Authorization: Securing the Non-Human Internet](https://daily.dev/posts/just-in-time-authorization-securing-the-non-human-internet-6ar68rfyq) · Nordic APIs · 0 upvotes · 0 comments --- Tags: [#observability](https://daily.dev/tags/observability), [#authorization](https://daily.dev/tags/authorization) [View this post on daily.dev](https://daily.dev/posts/hubspot-redesigns-jita-authorization-with-rule-engine-architecture-7srnyocbs) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"HubSpot Redesigns JITA Authorization with Rule Engine Architecture","url":"https://daily.dev/posts/hubspot-redesigns-jita-authorization-with-rule-engine-architecture-7srnyocbs","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/hubspot-redesigns-jita-authorization-with-rule-engine-architecture-7srnyocbs"},"datePublished":"2026-08-03T14:05:16.036Z","dateModified":"2026-08-03T14:05:36.190Z","description":"HubSpot redesigned its Just-In-Time Access (JITA) authorization system by replacing complex conditional logic with a rule engine architecture. Authorization...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/8fc3037015bbb4e0e7f831c9ac28ddda?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/8fc3037015bbb4e0e7f831c9ac28ddda?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"InfoQ","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"InfoQ","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/afc3bced3e1e4b188dd9127017a60e0c","url":"https://daily.dev/sources/infoq"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/hubspot-redesigns-jita-authorization-with-rule-engine-architecture-7srnyocbs","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"observability,authorization","timeRequired":"PT3M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"InfoQ","item":"https://daily.dev/sources/infoq"},{"@type":"ListItem","position":3,"name":"HubSpot Redesigns JITA Authorization with Rule Engine Architecture"}]} ```