Human-in-the-Loop Access Control

Assisted Login

Turn always-on connections into on-demand access

Assisted Login is a human-in-the-loop (HITL) access approval system that transforms how organizations manage privileged and third-party access. Instead of always-on VPN connections or standing access for vendors, Assisted Login requires real-time approval from a designated person before access is granted. Think of it as a digital key switch — access only happens when someone explicitly turns the key.

🔑

The Digital Key Switch Concept

Just as physical key switches in control rooms require a human to physically turn a key before critical systems activate, Assisted Login requires a human to explicitly approve before network access is granted. This human-in-the-loop verification eliminates the risk of automated attacks exploiting standing access. Approvals are received via Mideye+ push notifications for instant response.

How Does Access Approval Work?

👤
1. Access Request User or vendor attempts login
📱
2. Human Approval Designated approver notified instantly
3. Access Granted One tap approval, full audit log

How Does It Control Third-Party & Vendor Access?

The Problem with Always-On Vendor Access

Third-party vendors, MSPs, and contractors often receive permanent VPN credentials for maintenance and support. These always-on connections create a standing attack surface — if vendor credentials are compromised through phishing, credential stuffing, or supply chain attacks, adversaries gain the same persistent access the vendor had. Assisted Login removes the need for standing privileged access.

No Standing Access Vendor VPN accounts exist but have no access until your staff explicitly approves a session. Zero attack surface when not in use.
On-Demand Only Vendors connect only when needed, only when approved. Access is time-limited and tied to specific maintenance windows.
Full Accountability Every vendor session has a named internal approver. Your team owns the decision log. Complete audit trail for compliance.

Use Cases for Human-in-the-Loop Access

🔧

MSP & Vendor Access

External IT providers, software vendors performing maintenance, or cloud service integrations. Your operations team approves each session. No more 24/7 vendor VPN tunnels. Also see Shared Accounts for managing privileged credentials.

🏭

Shared Workstations

Factory floors, labs, or kiosks where multiple employees share computers. Supervisors approve access for team members without distributing shared passwords.

🎧

Help Desk & IT Support

Support staff need temporary access to resolve tickets. The assigned technician requests, the ticket owner or manager approves — with full audit trail for change management.

🚨

Break-Glass Access

Emergency scenarios where normal authentication isn't possible. Pre-authorized approvers can grant immediate access while maintaining security controls and compliance.

🏥

Healthcare & Shift Work

Nurses and doctors accessing patient systems. Charge nurses or attending physicians approve access for their team during the shift. HIPAA-compliant access controls.

🏛️

Critical Infrastructure

OT/ICS environments requiring dual authorization. Control room operators must approve remote maintenance access. The digital equivalent of a physical key switch.

Why Human-in-the-Loop Authentication Matters

The Problem with Standing Access

Traditional VPN and remote access solutions provide always-on connectivity. Once credentials are provisioned, the connection is available 24/7 — whether it's needed or not. This creates a permanent attack surface that threat actors can exploit through credential theft, phishing, or supply chain compromise.

The HITL Solution

Human-in-the-loop access approval ensures a real person consciously decides to grant access at the moment it's needed. Even if credentials are stolen, attackers cannot gain access without also compromising the approver. This adds a layer that automated attacks cannot bypass.

How Does It Integrate With Your Directory?

Active Directory Groups

Define who can request and who can approve based on existing AD group membership. No new directory schema required.

Azure AD / Entra ID

Works with hybrid and cloud-first environments. Validate approver membership against Entra ID groups for modern identity architectures.

Dynamic Pairing

Match requesters to approvers by group prefix or keyword pattern. Team-Alpha-Users approved by Team-Alpha-Approvers automatically.

Approval Methods

📱
Mideye+ Push Instant push notification to approver's phone
🔗
Magic Link Fallback SMS link if approver hasn't activated Mideye+

Security & Compliance

  • Full audit trail — Every request and approval logged with timestamps, user IDs, approver identity, and IP addresses. Supports SOC 2, ISO 27001, and regulatory audit requirements.
  • Real-time validation — Approver identity verified against directory at time of approval. Revoked accounts cannot approve.
  • Session timeout — Configurable approval validity period per profile. Access expires automatically.
  • Challenge questions — Optional additional prompts before approval (ticket number, reason code, maintenance window ID)
  • No shared secrets — Each approval is a unique, non-replayable authentication event. No emergency passwords to manage or rotate.

Assisted Login vs. Traditional PAM

Traditional Privileged Access Management (PAM) solutions focus on vaulting and rotating credentials. Assisted Login complements PAM by adding human approval at the moment of access — regardless of whether credentials are vaulted. This provides defense-in-depth: even if PAM credentials are compromised, the human approver gate remains.

Regulatory Compliance Support

Assisted Login implements the "four-eyes principle" (two-person rule) required by multiple compliance frameworks.

🔒 ISO/IEC 27001:2022 — Annex A 5.3

Requirement: "Conflicting duties and areas of responsibility shall be segregated to reduce the risk of fraud, error and the bypassing of information security controls."

How Mideye addresses this: Assisted Login enforces segregation by requiring two distinct users (requester and approver) for privileged access. The system prevents the same user from fulfilling both roles.

ISO 27001:2022 Annex A 5.3 Guide →

🏦 DORA RTS Article 21 — Privileged Access Management

Requirement: "Segregation of duties designed to prevent unjustified access... assignment of privileged... access on a need-to-use or an ad-hoc basis."

How Mideye addresses this:

  • Need-to-use basis: Time windows enforce temporary access
  • Segregation: Approver must be different from requester
  • Monitoring: Full audit trail of who requested, who approved, when, and for what purpose

DORA RTS on ICT Risk Management →

🇪🇺 NIS2 Directive — Access Control Policies

Requirement (Article 21, paragraph 2(i)): "Access control policies and asset management."

How Mideye addresses this: Policy-based approval workflows define which approvers can authorize access to which resources, with configurable time restrictions and multi-level approvals.

NIS2 Directive on EUR-Lex →

Note: Mideye provides the technical controls for segregation of duties and privileged access management. Achieving full ISO 27001 certification, NIS2 compliance, or DORA compliance requires comprehensive organizational programs. See our compliance hub for complete framework mappings, or consult your compliance team.

Implement Human-in-the-Loop Access Control

Assisted Login is included with Mideye Server 6.x. Contact us to discuss your access approval, vendor management, or supply chain security requirements.

Contact Sales →