Assisted Login
Turn always-on connections into on-demand access
Assisted Login is a human-in-the-loop (HITL) access approval system that transforms how organizations manage privileged and third-party access. Instead of always-on VPN connections or standing access for vendors, Assisted Login requires real-time approval from a designated person before access is granted. Think of it as a digital key switch — access only happens when someone explicitly turns the key.
The Digital Key Switch Concept
Just as physical key switches in control rooms require a human to physically turn a key before critical systems activate, Assisted Login requires a human to explicitly approve before network access is granted. This human-in-the-loop verification eliminates the risk of automated attacks exploiting standing access. Approvals are received via Mideye+ push notifications for instant response.
How Does Access Approval Work?
How Does It Control Third-Party & Vendor Access?
The Problem with Always-On Vendor Access
Third-party vendors, MSPs, and contractors often receive permanent VPN credentials for maintenance and support. These always-on connections create a standing attack surface — if vendor credentials are compromised through phishing, credential stuffing, or supply chain attacks, adversaries gain the same persistent access the vendor had. Assisted Login removes the need for standing privileged access.
Use Cases for Human-in-the-Loop Access
MSP & Vendor Access
External IT providers, software vendors performing maintenance, or cloud service integrations. Your operations team approves each session. No more 24/7 vendor VPN tunnels. Also see Shared Accounts for managing privileged credentials.
Shared Workstations
Factory floors, labs, or kiosks where multiple employees share computers. Supervisors approve access for team members without distributing shared passwords.
Help Desk & IT Support
Support staff need temporary access to resolve tickets. The assigned technician requests, the ticket owner or manager approves — with full audit trail for change management.
Break-Glass Access
Emergency scenarios where normal authentication isn't possible. Pre-authorized approvers can grant immediate access while maintaining security controls and compliance.
Healthcare & Shift Work
Nurses and doctors accessing patient systems. Charge nurses or attending physicians approve access for their team during the shift. HIPAA-compliant access controls.
Critical Infrastructure
OT/ICS environments requiring dual authorization. Control room operators must approve remote maintenance access. The digital equivalent of a physical key switch.
Why Human-in-the-Loop Authentication Matters
The Problem with Standing Access
Traditional VPN and remote access solutions provide always-on connectivity. Once credentials are provisioned, the connection is available 24/7 — whether it's needed or not. This creates a permanent attack surface that threat actors can exploit through credential theft, phishing, or supply chain compromise.
The HITL Solution
Human-in-the-loop access approval ensures a real person consciously decides to grant access at the moment it's needed. Even if credentials are stolen, attackers cannot gain access without also compromising the approver. This adds a layer that automated attacks cannot bypass.
How Does It Integrate With Your Directory?
Define who can request and who can approve based on existing AD group membership. No new directory schema required.
Works with hybrid and cloud-first environments. Validate approver membership against Entra ID groups for modern identity architectures.
Match requesters to approvers by group prefix or keyword pattern. Team-Alpha-Users approved by Team-Alpha-Approvers automatically.
Approval Methods
Security & Compliance
- Full audit trail — Every request and approval logged with timestamps, user IDs, approver identity, and IP addresses. Supports SOC 2, ISO 27001, and regulatory audit requirements.
- Real-time validation — Approver identity verified against directory at time of approval. Revoked accounts cannot approve.
- Session timeout — Configurable approval validity period per profile. Access expires automatically.
- Challenge questions — Optional additional prompts before approval (ticket number, reason code, maintenance window ID)
- No shared secrets — Each approval is a unique, non-replayable authentication event. No emergency passwords to manage or rotate.
Assisted Login vs. Traditional PAM
Traditional Privileged Access Management (PAM) solutions focus on vaulting and rotating credentials. Assisted Login complements PAM by adding human approval at the moment of access — regardless of whether credentials are vaulted. This provides defense-in-depth: even if PAM credentials are compromised, the human approver gate remains.
Regulatory Compliance Support
Assisted Login implements the "four-eyes principle" (two-person rule) required by multiple compliance frameworks.
🔒 ISO/IEC 27001:2022 — Annex A 5.3
Requirement: "Conflicting duties and areas of responsibility shall be segregated to reduce the risk of fraud, error and the bypassing of information security controls."
How Mideye addresses this: Assisted Login enforces segregation by requiring two distinct users (requester and approver) for privileged access. The system prevents the same user from fulfilling both roles.
🏦 DORA RTS Article 21 — Privileged Access Management
Requirement: "Segregation of duties designed to prevent unjustified access... assignment of privileged... access on a need-to-use or an ad-hoc basis."
How Mideye addresses this:
- Need-to-use basis: Time windows enforce temporary access
- Segregation: Approver must be different from requester
- Monitoring: Full audit trail of who requested, who approved, when, and for what purpose
🇪🇺 NIS2 Directive — Access Control Policies
Requirement (Article 21, paragraph 2(i)): "Access control policies and asset management."
How Mideye addresses this: Policy-based approval workflows define which approvers can authorize access to which resources, with configurable time restrictions and multi-level approvals.
Note: Mideye provides the technical controls for segregation of duties and privileged access management. Achieving full ISO 27001 certification, NIS2 compliance, or DORA compliance requires comprehensive organizational programs. See our compliance hub for complete framework mappings, or consult your compliance team.
Implement Human-in-the-Loop Access Control
Assisted Login is included with Mideye Server 6.x. Contact us to discuss your access approval, vendor management, or supply chain security requirements.
Contact Sales →