See how Delinea denies a write to a payment record, even though the engineer already has approved access, until an administrator reviews the action itself.
The engineer already has access to the database.
That is where most Access tools stop here.
It’s the starting point.
Policy sits on one table in this production database, the one holding payment methods, and it requires a person to approve any changes to it.
Entitlements are already in place.
Nothing that follows is about getting in.
The engineer works in Beekeeper studio, their own client, not something we made them install.
They open the payment methods table and edit a name, apply and the right is denied.
Not the login, not the session, the statement.
The request is now sitting in the approval queue raised by the attempt itself.
Nobody had to file anything.
The approver sees who the user is and what they’re trying to do.
Approving a person is a guess.
Approving an action is a decision approved back in the same session, the same client, the same unsaved edit apply and it goes through and the log confirms it.