HubSpot Builds Observable Access Control with Rule Engine JITA System

HubSpot has overhauled its just-in-time access (JITA) authorization system, replacing tangled conditional logic with a rule-engine architecture designed to make access decisions transparent and auditable. The new design evaluates temporary access grants through independent, modular rules rather than deeply nested code, enabling engineers to trace exactly how each policy affects whether someone gets access and where processing bottlenecks occur.

The Problem with Legacy Logic#

HubSpot's JITA infrastructure handles roughly 5,500 access requests daily across a workforce of 10,000. The original system relied on increasingly convoluted if-then-else structures as new access scenarios accumulated over time. While this technically worked, engineers struggled to diagnose why specific requests succeeded or failed—and which validation checks were adding latency.

Rule-Based Architecture for Clarity#

The redesigned system replaces embedded logic with independent rules organized in a directed acyclic graph (DAG). Each rule evaluates authorization criteria and produces structured output: decision results, execution timing, and metadata that explains the reasoning. Rather than a monolithic black box, the system became a collection of visible, measurable checks.

The architecture reflects HubSpot's core redesign goal: moving beyond asking "does this work?" to answering "can we explain every decision, to anyone, at any time?"

Shared Context, Isolated Execution#

The implementation centralizes request data—user attributes, team memberships, request details—into a common context passed to all rules. This avoids redundant lookups and ensures consistent inputs. Rules run in isolation: if one fails due to an unavailable dependency, the system logs the failure while other rules continue, and access decisions proceed based on the remaining results.

Observability and Governance#

The system now provides rule-level telemetry: individual execution times, failure rates, and outcomes. A recertification dashboard lets stakeholders review usage metrics and identify slow or problematic policies. Before full rollout, engineers ran the old and new systems side-by-side, comparing decisions to validate correctness.