Skip to content

Elevated Access

Applies to: All subscriptions. Strict governance mode is set by Complifly, with your agreement.

Purpose

Explain three controls that deal with rights held more widely, or for longer, than the need behind them: Emergency Access (rights lent for a short time), the support window (your consent to Complifly support reading your company), and second approval (a privileged role that waits for another person). State exactly what each does, who can use it, and what the Governance mode setting changes.

Audience

The customer's system administrators and finance control owner, and internal audit.

Prerequisites

Reference

The short version

Standard mode (the default) leaves everything as it was and adds the three controls as options. Strict mode makes them compulsory. Strict is set for your company by a Complifly Super Admin; you cannot change it yourself.

Standard Strict
Emergency Access Your Org Admin, or Complifly, can lend rights for 15 minutes to 24 hours Only Complifly, with your approval reference, for 15 minutes to 4 hours
Support window Optional. If your Org Admin opens one it is recorded and announced Complifly support and platform engineers can read your company only while a window your Org Admin opened is open
Second approval Org Admin and Super Admin roles are assigned at once Assigning either waits for a second person to approve

Everything is under Admin & Logs > Access > Elevated access.

Emergency Access

Lends the rights of one role to one person for a fixed time, with a written reason. It ends by itself. Nothing needs to be cleaned up and nobody has to remember.

Question Answer
What is lent The rights of Tax Controller, Tax Executive, Transport Manager or Logistics Operator, as they are with segregation of duties on. A loan never adds what switching segregation of duties off would add
What is never lent Org Admin, Super Admin, any Complifly role, External Auditor, Approver
Who can lend (Standard) Your Org Admin or a Complifly Super Admin. Never to themselves
Who can lend (Strict) A Complifly Super Admin only, with your approval reference. Never to themselves
How long 15 minutes to 24 hours (Standard); 15 minutes to 4 hours (Strict)
How many at once One per person
Which registrations Only the ones the person already has access to. A loan changes what they may do, never where
Who is told Your company's other Org Admins, by email, when it is granted. The person who lent it is not emailed
What is recorded EMERGENCY_ACCESS_GRANTED and EMERGENCY_ACCESS_REVOKED, and every audit entry written while the person acts under the loan carries accessBasis: EMERGENCY_ACCESS and the grant id, so an auditor can separate what was done under a loan from what the role allows
Ending early Your Org Admin or Complifly, with a reason

Use it for: a month-end backlog while the controller is away, or an urgent cancellation inside its window. Do not use it for: a standing need. If someone needs the right every month, change their role.

The support window

A period you open in which Complifly support and platform engineers may read your company.

Question Answer
Who opens one Your own Org Admin only. Complifly cannot open one for itself: it is your consent
How long 1 hour to 7 days (24 hours by default)
What is needed A reason; a support ticket reference if there is one
Who is told Your other Org Admins, by email
In Strict mode, without a window Complifly support and platform engineers get 403 SUPPORT_WINDOW_REQUIRED, and the attempt is recorded in your Audit Logs as SUPPORT_WINDOW_DENIED
Who is not held to it A Complifly Super Admin. A Super Admin configures customers (onboarding, plan, policy, GSP) and has to be able to; every such act is already recorded against your company. Acting on your documents in an emergency goes through Emergency Access, which needs your approval reference in Strict mode
Closing early Your Org Admin, or Complifly

What the window does not cover

It does not cover platform-wide health screens that show aggregates across every company and name none of them. Those are restricted to Complifly's three staff roles.

Second approval for a privileged role

In Strict mode, giving someone the Org Admin or Super Admin role takes effect only when a second person approves it.

Question Answer
What waits Creating an account with the role (it is created inactive and cannot sign in), and changing an existing account to it (the person keeps their current role)
What does not wait Any other role, and taking a privileged role away
Who approves Org Admin Another Org Admin of your company, or a Complifly Super Admin. Never the person who asked
Who approves Super Admin Another Complifly Super Admin
One Org Admin only A Complifly Super Admin can approve, so the company is never stuck
On approval The role is applied, the account is activated, and the person's old sessions end, all together
On rejection Nothing changes. A note is required, and the person who asked sees it
While it waits The person cannot be activated or moved to another role by editing them a different way
Who is told Your other Org Admins, when it is requested

What Governance mode changes, and what it does not

It changes the three rows in the first table and nothing else. It does not change segregation of duties, any permission, or any module switch. It is a company-wide setting, recorded in the control's Audit History like any other. Moving from Strict back to Standard is a Complifly Super Admin act with no extra confirmation; if you rely on Strict, ask Complifly to tell you when it is changed.

Validation

Check Method Pass condition
Mode is what was agreed Elevated access shows "Governance mode: Strict" or "Standard" Matches the written agreement
A loan ends by itself Lend 15 minutes to a test user; try the action before and after Works, then is refused with PERMISSION_DENIED
A loan is marked Audit Logs, search EMERGENCY_ACCESS The action carries accessBasis and the grant id
A loan cannot be self-granted Try lending to yourself EMERGENCY_SELF_GRANT
Strict support window As Complifly support, read the company with no window open SUPPORT_WINDOW_REQUIRED, and SUPPORT_WINDOW_DENIED in your Audit Logs
Second approval In Strict mode, create an Org Admin account The account is inactive until another person approves; the requester cannot approve it
Others are told Check another Org Admin's mailbox A notice for each of the three

Troubleshooting

Symptom Cause Action
"Only Complifly can lend emergency access" (EMERGENCY_GRANT_STRICT) Your company is in Strict mode Ask your Complifly contact, with your approval reference
Complifly support says they cannot see your company (SUPPORT_WINDOW_REQUIRED) Strict mode and no window is open Open one under Elevated access, then tell them
You cannot open a support window You are not your company's Org Admin, or one is already open Ask your Org Admin; close the open one first
"You made this request, so you cannot decide it" (ROLE_REQUEST_SELF_DECISION) The person who asked cannot approve Ask another Org Admin, or Complifly if you are the only one
An account is created but cannot sign in A privileged role is waiting for approval Approve it under Elevated access > Role approvals
"This person has a role request waiting" (ROLE_REQUEST_PENDING) You tried to activate or re-role someone with a pending request Decide the request first
A loan was granted but the buttons do not show The screen reads the loan once a minute Wait up to a minute or reload. The server already accepts the action
You cannot lend an Org Admin's rights Org Admin, Super Admin and Complifly roles are never lent Use second approval, or change the role