> For the complete documentation index, see [llms.txt](https://docs.apono.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.apono.io/docs/access-flows/creating-access-flows-in-apono/access-duration.md). # Access Duration **Access duration** is the period of time that a user is able to use a resource before Apono automatically revokes access. Access duration depends on two settings.

Setting	Description
Granting period	Maximum amount of time access can be granted for a resource, defined when creating a self serve access flow A granting period is specific to an access flow and required for every self serve access flow.
Require duration for access request	Account-level setting that requires requestors to specify how long they need access when submitting an access request The requested duration cannot exceed the granting period. If this setting is not enabled, approved access uses the full granting period defined in the access flow.

Setting

Description

Granting period

Maximum amount of time access can be granted for a resource, defined when creating a self serve access flow

A granting period is specific to an access flow and required for every self serve access flow.

Require duration for access request

Account-level setting that requires requestors to specify how long they need access when submitting an access request

The requested duration cannot exceed the granting period.

If this setting is not enabled, approved access uses the full granting period defined in the access flow.

{% hint style="info" %} The granting period is not always the exact amount of time a requestor receives. When requestors are required to specify a duration, they can request less time than the granting period. The granting period is the **maximum available** time for the request. {% endhint %} When a request is submitted, the approver sees the requested duration along with other request details. Once a request is approved, access is granted only for the specified period and is revoked when the approved access period ends. If the requestor needs more time, a new access request should be submitted unless [extended access](/docs/access-flows/creating-access-flows-in-apono/self-serve-access-flows.md#allow-extend-duration) has been enabled for the access flow. By enforcing time limits, access duration provides the following benefits: * Reduced standing access * Improved accountability * Support for just-in-time access aligned with the principle of least privilege. {% hint style="info" %} All Apono access requests, approvals, and expirations are logged and retained for at least **36 months**. For longer retention needs, export this data to your organization’s storage tools. {% endhint %} *** ### Granting period best practices A granting period is defined when [creating a self serve access flow](/docs/access-flows/creating-access-flows-in-apono/self-serve-access-flows.md#set-access-duration-and-approval-process) and should be based on the risk and sensitivity of an access flow's resources. Use the recommendations in the table below as a starting point to define granting periods that meet your organization’s security and operational needs. The **Typical Requested Duration** column reflects how long access is usually needed to complete a task.The **Granting Period** column defines the upper limit configured in the self serve access flow.

Use Case	Typical Requested Duration	Granting Period	Approval Type (UI)	Settings (UI) & Guidance
Development / Sandbox / Staging / QA	Quarterly	No fixed recommendation Based on role and environment risk	Automatic Approval	Guidance: Longer durations are acceptable due to lower risk, especially when tied to developer roles.
Production Systems	Up to 2 hours	4 hours	Approval of OR Automatic Approval	Settings: Require MFA Requester and grantee cannot self approve Guidance: Approval of: Choose an approver from a production team, such as DevOps or Infra. Automatic Approval: Select this approval type for ongoing incidents or during on-call shifts.
Sensitive Data (PII, Financial, Customer)	Up to 1 hour	2 hours	Approval of	Settings: Require Approver Reason Requester and grantee cannot self approve Guidance: The approver should be able to authorize sensitive data access such as Security team, GRC, or manager.
Break-glass / Emergency	Up to 1 hour	2 hours	Approval of OR Automatic Approval	Setting: Require MFA Guidance: The request should be reviewed post-incident. Ticket ID may be required to make the request Approval of: Choose an approver from an on-call shift or production team, such as DevOps or Infra. Automatic Approval: Select this approval type for ongoing incidents or during on-call shifts.

{% hint style="success" %} After granting periods are defined, Apono analyzes access requests and identifies **Excessive access duration** when requested durations are consistently below the configured maximum. Through [Right Sizing](/docs/access-flows/manage-access-flows/right-sizing.md), Apono recommends reviewing and reducing granting periods to better align with least-privilege access. {% endhint %} *** ### Enable Require duration for access request By default, the **Require duration for access request** is disabled. We recommend enabling this setting to help limit approved access to the time requestors need to complete a task.

Require duration for access request toggle

Follow this step to require requestors to specify a duration: 1. On the [**Settings**](https://app.apono.io/settings) page, click the **Require duration for access request** toggle to on. The toggle will turn green. Once enabled, requestors must specify a duration a duration that **does not exceed** the [granting period](/docs/access-flows/creating-access-flows-in-apono/self-serve-access-flows.md#set-access-duration-and-approval-process) defined by the access flow. If the requested duration exceeds the granting period or is invalid, an error message prompts the requestor to enter a valid duration. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter: ``` GET https://docs.apono.io/docs/access-flows/creating-access-flows-in-apono/access-duration.md?ask= ``` The question should be specific, self-contained, and written in natural language. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.