AI Access Requests
AI Access Requests give employees a self-service way to ask for an AI tool. Approvers are notified in ANTS Platform and, if you choose, in Slack and Jira. On approval, ANTS Platform can add the requester to the Okta or Entra ID group that unlocks the tool. A cycle-time report shows how long decisions take by risk tier.
How it works
An employee submits a request
The employee opens the request page, directly or from the request link in a Warn mode banner, and fills in the form.
Approvers are notified
Approvers get a notification in ANTS Platform. If you chose a Slack channel or a Jira project, ANTS also posts the request there.
An approver decides
The approver opens the request in the Review queue and approves or rejects it. Opening a new request moves it to In review.
Access is granted
On approval, if the tool is mapped to a group and access grants are on, ANTS adds the requester to that group. The requester is notified of the decision.
Each request stores a timestamp for every stage, which feeds the cycle-time report.
Prerequisites
- The Enterprise plan (
enterprise-governanceentitlement). - The AI tool access requests feature turned on for the organization. See Turn on the feature.
- To submit a request: AI tool access requests access. Owner, Department Admin, Security & Compliance, Cost Analyst, Manager Viewer and End User have it by default. Employees with no ANTS role can also submit when you allow it. See Employees without an ANTS role.
- To review requests: AI tool access requests at the admin level, which Owner, Department Admin and Security & Compliance have by default. See Members & Roles.
- For Slack and Jira notifications: the Slack or Jira integration connected to a project.
- For automatic access grants: Okta or Microsoft Entra ID connected through
Directory Integration, with a
credential that can manage group membership:
- Okta: a token with the Group Membership Administrator role.
- Microsoft Entra ID: the Microsoft Graph application permissions
GroupMember.ReadWrite.AllandUser.Read.All, with admin consent.
Directory credentials cannot be edited after you connect. To give an existing connection permission to manage groups, disconnect it and connect again with the new credential.
Turn on the feature
Go to Organization Settings > Features and turn on AI tool access requests. Changing features needs feature admin access. Once it is on, AI Access Requests appears in the Governance group of the sidebar, and Organization Settings > AI Access Requests appears.
Set up requests
Go to Organization Settings > AI Access Requests. The page has four sections:
| Section | What you set | Who can change it |
|---|---|---|
| Notifications | A Project whose Slack and Jira integrations receive new requests, then a Slack channel and a Jira project key. Choose In-app and email only to skip Slack and Jira. | Admin access to AI tool access requests |
| Access grants | One switch per connected directory, Okta or Entra ID. Turning it on checks that the credential can add group members and shows when write access was verified. | Organization Discover AI configure write access |
| Tool groups | The identity provider group that unlocks each tool. Pick a tool, a provider and a group, then select Save mapping. Tools with no group are set up by hand. | Organization Discover AI configure write access |
| Employees without an ANTS role | Whether employees who sign in with company SSO can request tools without becoming members, and the company domains they must belong to. | SSO administration access |
Changing access grants, tool groups and the employee settings asks for step-up verification when it is enabled.
ANTS only adds people to groups. It never removes anyone from a group. To revoke access, remove the person in Okta or Entra ID.
Share the request page
Give employees the organization request page,
https://<your ANTS Platform host>/ai-access/<organization ID>. Members who
open it are taken to their project's AI Access Requests page, and employees
without an ANTS role see the request form when you allow them. Publish the link
where employees look for help, and use it as the Request link in
Warn mode.
Use the organization link, not a project URL. A project URL such as
/project/<project ID>/ai-access only works for members of that project.
In Warn mode, Use as request link fills in the organization link for you.
Employees without an ANTS role
You can let employees who have no role in ANTS Platform request tools. They open the organization request page, sign in with your company SSO, and see the form and their own requests. They do not become members and see nothing else.
Add and verify your domains
Under Company domains, enter a domain and select Add domain. Add the TXT record the page shows at your DNS provider, then select Verify:
| Record name | Value |
|---|---|
_ants-verification.<domain> | ants-domain-verification=<token> |
Public email services such as gmail.com or outlook.com are rejected. An organization can claim up to 20 domains, and a domain already verified by another organization cannot be claimed.
Choose who can request
Turn on Takes requests for each verified domain, and turn on Take requests from employees signed in with company SSO.
Save
Select Save. This section needs SSO administration access. Without it, the section is view only.
Who can use the page:
- The person's email domain must be one of the chosen, verified domains.
- They must sign in with enterprise single sign-on. Password sign-in, email code sign-in and personal Google, GitHub or GitLab sign-ins do not count.
- When the domain has its own SSO configuration in ANTS Platform, only that identity provider counts.
People who do not qualify see a message that explains why, for example "Sign in with your company's single sign-on to request AI tools." Requests from these employees are marked No ANTS role, company SSO in the review queue.
The request page
Members open AI Access Requests in the sidebar. The page has three tabs:
| Tab | What it shows | Who sees it |
|---|---|---|
| My requests | The request form and the status of your own requests. You can cancel a request that is still open. | Everyone who can request |
| Review queue | Requests to decide, filtered by Open, Approved, Rejected, Cancelled or All, with search by tool or requester. | Approvers |
| Cycle time | The cycle-time report. | Approvers |
The request form has these fields:
| Field | What the employee enters |
|---|---|
| AI tool | A tool from the catalog, which shows its risk tier and sanction status. If the tool is not listed, the employee can type its name. Tools outside the catalog are reviewed by hand and cannot be granted automatically. |
| Use case | What they will do with the tool. |
| Data you will put into it | One or more of Public information, Internal business data, Customer data, Personal data (PII), Financial data, Source code and Confidential or regulated data. |
| Business justification | Why the business needs it. |
When the page is opened with ?tool=<tool ID>, the form opens with that tool
filled in. The browser extension adds this to the Warn mode request link. See
Warn mode.
Review and decide
Approvers open a request from the Review queue, the notification, the Slack message or the Jira issue. The request shows the requester, use case, data and business justification. Add an optional Note to the requester, then select Approve or Reject. Approvers cannot decide their own requests.
When approving a catalog tool that is not Sanctioned, an approver with AI Tools manage access can also choose to mark the tool Sanctioned for the whole organization. Sanction status applies to everyone, so leave it off to grant access to this person only.
| Status | Meaning |
|---|---|
| Submitted | Sent and not yet opened by an approver. |
| In review | An approver opened it. |
| Approved | Approved. Access is granted where a group is mapped. |
| Rejected | Rejected. Nothing changes for the requester. |
| Cancelled | The requester cancelled it. |
The decision is added to the Slack thread and the Jira issue.
What happens on approval
- Group membership: if the tool is mapped to a group and access grants are on for that directory, ANTS adds the requester to the group. Your identity provider then gives them the tool through that group's app assignments. The request shows Access granted, or Grant failed with Retry grant.
- No mapped group: the decision is recorded and no group changes (No group mapped). Arrange access the way you do today.
- Sanction status: unchanged, unless the approver chose to mark the tool Sanctioned for the organization.
Cycle-time report
The Cycle time tab shows the AI access request cycle time report: the hours from an employee's request to the approver's decision, by the tool's risk tier at the time of the request. Filter by tool and by Last 30 days, Last 90 days, Last 180 days or Last 12 months, and select Export CSV to download it.
- Headline figures: Requests, Median time to decision, P90 time to decision and Approval rate.
- By risk tier: requests, decided, approved, rejected and median hours for Critical, High, Medium, Low and Unknown. The tier is the tool's risk level from the registry or your override. Tools outside the catalog are Unknown.
- Request volume by status: every request created in the range, by where it stands now.
Cancelled and still-open requests count toward volume, not cycle time.
Limits
- Every request goes to an approver. Automatic approval for low-risk requests, and parallel review by several groups with service levels, are on the roadmap.
- Risk tiers are the tool's risk level. Configurable risk tiers and intake questionnaires are on the roadmap.
- Time-limited policy exceptions are on the roadmap.