SOP-001 — Access request & approval

Standard Operating Procedure · owner: Operations (Process Engineer) · binding via the Employee Handbook. Layer: SOP/Runbook (docs/canon.md).

Purpose

Give every employee a clear, fast path to request the resources they need when they lack them — and a lightweight approval that keeps least-privilege intact. The request is the GR-4 needs analysis.

When to use

You hold standing access to what your role needs (hr/policies/resource-access.md). Use this SOP when you lack a needed resource — a tool, an integration/MCP, a permission, a secret, or access to a body of knowledge.

Flow

flowchart LR
  R["Request<br/>need + justification"] --> V{"Review<br/>by class owner"}
  V -->|approved| A["Approve"]
  A --> G["Grant<br/>edit tools / settings"]
  G --> L["Record<br/>in register"]
  V -->|denied| L
  classDef s fill:#1d4ed8,color:#fff,stroke:#1e3a8a
  classDef d fill:#0f766e,color:#fff,stroke:#134e4a
  class R,A,G,L s
  class V d

Text fallback: Request (need + justification) → Review by the class owner → if approved, Approve → Grant (edit the agent’s tools: / settings) → Record in the register; if denied, go straight to Record.

Steps

1. Request. Add a row to the register (hr/access/requests.md): who, the resource, its class, the need + justification, scope, and duration (standing or time-boxed).
2. Review by the resource-class owner (below), applying GR-4 (least access the need justifies) and the Security policy.
3. Approve / deny with a one-line rationale.
4. Grant (if approved): the actual change — edit the agent’s tools: frontmatter and/or .claude/settings*.json permissions; for knowledge, link it in docs/canon.md.
5. Record the decision and (if granted) the grant location in the register.

Approvers by resource class

Guardrails

• Least privilege (hr/policies/security.md): grant the minimum scope the need justifies; prefer time-boxed over standing for sensitive access.
• No secrets in the repo — secrets live in env/Action secrets; the register records that access was granted, never the secret itself.
• Outward-facing or sensitive grants are Principal-approved.