Employee Access Request & Approval
An employee needs temporary access to a system. Today that's a ticket, a manager ping, and a manual grant — with no consistent record of why access was approved or when it should expire.
The Goal
What you'd actually type to Dendr AI
Natural-language input
“Grant Priya Patel 30 days of read access to the Atlas client environment.”
The Ecosystem
Agents & MCP servers orchestrated
Access management
ServiceNow
Illustrative vendor
Creates and tracks the access-request record, including expiry.
Collaboration
Slack
Illustrative vendor
Notifies the requester's manager for approval.
Communication
Graph / SMTP MCP
Confirms the grant and expiry date to the requester.
How It Works
How the Dynamic Planner builds the chain
The Intent Engine structures the goal above into an intent graph. The Dynamic Planner grounds each step against the live Agent Capability Graph and assembles the coordination path at request time — no one pre-authored this exact sequence.
Create the access-request record in ServiceNow with the requested scope and a 30-day expiry.
Notify the requester's manager in Slack for approval.
On approval, mark the ServiceNow record active and schedule the automatic revocation at day 30.
Email the requester confirming access and the expiry date.
Semantic Routing in Action
The right agent, every time
This is the simplest routing case in the set on purpose — it's a good first example because there's nothing to explain away.
access.request.create exact-matches ServiceNow — the only registered agent carrying that capability tag in the IT-ops domain.
collaboration.approve matches Slack directly; no semantic tie-break is needed because only one approval-capable collaboration agent is registered for this tenant.
Approve Once. Use Anytime.
Chain-level authorization, reused on every run
- IT leadership approves the “standard access request” pattern once — covering request, manager approval, and time-boxed grant as a single authorized chain.
- Every future access request of this type runs under that same standing approval, with requester, scope, and duration substituted in each time.
- Because expiry is built into the authorized chain itself, access doesn't linger past its approved window waiting on someone to remember to revoke it.
Dynamic Replanning & Resilience
What happens when reality doesn't match the happy path
If the manager doesn't respond within a configurable window, the planner escalates the Slack notification to a backup approver rather than leaving the request stalled indefinitely.
Business Outcome
What the IT team gets
Access requests resolved in minutes instead of sitting in a queue.
No orphaned access — every grant has a built-in, authorized expiry.
A simple, complete record of who approved what access and for how long.
Related
The matched pair
See how IT teams grant access safely with Dendr AI.
Get a demo and see the access-request chain run against your own registered agents.
ServiceNow and Slack are referenced above as illustrative, recognizable examples of the enterprise systems Dendr AI can orchestrate through A2A, MCP, vendor adapters, or OpenAPI manifests. These are reference architectures, not case studies of named customers, and do not imply a partnership, integration certification, or endorsement by those vendors.