Lifecycle & Access Governance
Request Role
Request a role for yourself or someone you can request for, and submit it in one cart with any privileges you need.
Completes when the approved role and its privileges are provisioned.
https://mcp.avatier.com/mcp
Ask in Plain Language
Run Request Role from the AI Assistant You Already Use
The role's approval workflow decides who approves, with no admin bypass, and identity verification first in Avabot and MCP. One completed role request = one Secure Outcome; failed attempts are never billed.
You: Request the Sales Manager role for Priya Shah, starting Monday. Reason: promotion. Avatier: verify: passed · role: picked from list · for: Priya Shah · start: Monday · request: submitted
Why it matters
A Role Request Should Carry Its Reason to the Approver.
Roles bundle privileges, so the request that grants one needs the right role, the right person, the dates and a reason.
What a request needs
A role found by search or browse, requested for yourself or someone you can request for, with a justification, a start date and an end date.
What goes wrong by hand
A manual process leaves access verification hard for managers, security professionals, and auditors to see.
Why it matters now
Without a governed request path, grandfathered access, orphaned accounts, and unnecessary access to critical systems can go unnoticed.
What per-seat pricing charges
Per-seat IAM charges for every licensed seat, whether anyone requests a role this month or not. Pay Per Identity Action™ charges only for completed role requests.
The Action
How Request Role Runs
On the web, roles are requested through the same cart as privileges. In Avabot and MCP you verify, search by keyword, pick one role from a numbered list, name who it is for, give a reason and set the dates.
Verify in Avabot or MCP
Avabot and MCP only. Request Role starts with identity verification in the conversation, with the methods your policy already allows, such as Security Questions, Google Authenticator, PingID push or Identity Challenge Card. On the web there is no extra check beyond your sign-in. A verification earlier in the same conversation carries over.
Identity Verification (Avabot and MCP)
Select Who It Is For
Pick the recipient: yourself, or someone your Lifecycle Management authority lets you request for. That is checked when you submit.
Find the Role
Search by name, in icon, list or detail view, or Browse from "All role containers" through nested containers to roles. Hidden roles are not listed.
Fill in the Form
Open the role and enter a Justification (required), a Start (now or a date) and an End (no expiration or a date). A role with a privilege that creates an account asks for a Provisioning password, and some privileges need form fields.
Add to Cart
Add the role to the Request Cart and repeat as needed. Privileges and roles can share one cart.
Submit All
Open the Request Cart and tap Submit all. The Results list shows each item's Request ID. Each request goes through the role's approval workflow; there is no admin bypass. A role that contains no privileges creates no request, and the portal says so.
Approval point
Available on Web, Mobile, Teams, Avabot chat and MCP.
Avabot chat and MCP require the current (.NET 10) Avatier server.
In Avabot chat and MCP, each request covers one role, picked from a numbered list after a keyword search.
Request Role on the web, mobile and Teams also needs the .NET 10 server. On the .NET 4.8 server, roles are requested in the legacy Lifecycle Management console.
Secure Outcome
What Counts as Done
A Secure Outcome is a completed, verified, policy-compliant identity action. A role request completes when the approved role and its privileges are provisioned, through their connectors or manual grant tasks. Each cart item is its own request, recorded in Request History with a Request ID. One completed role request = one Secure Outcome.
Evidence
- A Request ID for each cart item, shown in the Results list
- An activity-log entry for each request
- Request emails
Guardrails
Your Assistant Asks. Avatier Decides.
Verified First
Avatier verifies the person before sensitive changes, with the methods your policy already allows.
Acts as the Signed-In User
OAuth sign-in to your own tenant. No shared service account, no API key to manage.
Never Makes Up Values
The connector only sends what the person actually said, and asks when something is missing.
Every Request Recorded
Requests land in Request History, ready to review and export.
Pay Per Identity Action™
Pay per Completed Role Request
Pay per completed role request. Failed attempts are never billed.
| Compared | Manual or Per-Seat IAM | Request Role, Pay Per Identity Action™ |
|---|---|---|
| What you pay for | Every licensed seat, whether it acts or not | Completed role requests only |
| Failed attempts | No line between an attempt and a result | Attempts, failures and retries are never billed |
| The work | Manual intervention or tickets | Each role becomes its own request, and the role and its privileges are provisioned after approval |
| Evidence | Silent failures and missing audit trails | A Request ID per item, an activity-log entry and request emails |
Pay Per Identity Action™ is in invitation-only preview. Pricing is shared with qualified organizations.
Works with the Systems Request Role Touches
Request Role provisions the role's privileges to their systems through connectors, such as Active Directory or Entra ID groups, LDAP or application entitlements, or through manual grant tasks for privileges that people fulfil.
- LDAP
- Microsoft
- Active Directory and Entra ID groups, through their connectors.
- Other Systems
- LDAP and application entitlements through their connectors, or manual grant tasks for privileges people fulfil by hand.
Avatier MCP
New to Avatier MCP?
The Model Context Protocol is an open standard, stewarded by the Linux Foundation, that lets AI assistants call real systems through connectors instead of custom integrations.
Up and Running in Under a Minute
One URL works in every MCP client. Pick yours, copy, paste, sign in.
Microsoft Copilot Studio
Claude Code
OpenAI Codex
Cursor
Frequently Asked Questions
Is Request Role available on our .NET Framework (4.8) server?
Not in the web app, mobile app, Teams or Avabot; those need the .NET 10 server. On .NET 4.8, roles are requested in the legacy Lifecycle Management console.
Can I request a role and some individual privileges together?
Yes. Roles and privileges share one Request Cart and are submitted together, each with its own Request ID.
Who can receive the role?
You, or someone your Lifecycle Management authority lets you request for. The role catalog isn't personalized: who may receive the role is checked when you submit.
Does Avatier provide AI-driven compliance reporting?
Yes. Avatier turns continuous identity and access data into audit-ready reports on demand, using AI to assemble who has access to what, what changed, and who approved it, mapped to the controls auditors expect. Instead of a manual evidence scramble before each audit, you generate plain-language, exportable reports covering SOC 2 Type II and ISO 27001, plus the evidence needs associated with NIST, SOX, HIPAA, and GDPR.
What is AI-driven configuration?
Avatier's AI-driven config turns plain-language intent into working policy. Rather than hand-coding rules, connectors, and roles, administrators describe what they need and Avatier recommends and sets up provisioning rules, role mappings, and workflows, then validates them before they go live. It shortens deployment from months to days and keeps configuration consistent, auditable, and free of custom scripting.
What is Pay Per Identity Action™?
Pay Per Identity Action™ is Avatier's pricing mechanic. Customers pay only for completed, verified, policy-compliant identity actions, called Secure Outcomes.
Is it the same as pay-per-action advertising?
No. Pay per action (PPA) is performance-marketing vocabulary for paying when an ad converts. Pay Per Identity Action™ charges for completed identity work.
How do I get started?
Getting started is free, deployment services are included, and a 45-day money-back guarantee applies. Contact Avatier for pricing for your organization.
What is MCP?
The Model Context Protocol is an open standard, stewarded by the Linux Foundation, that lets AI assistants call real systems through connectors instead of custom integrations.
How is it billed?
Pay Per Identity Action™ is in invitation-only preview: each completed, verified action is one Secure Outcome, and attempts, failures and retries are never billed.
Request Role
Every Request, with a Request ID.
Search or browse roles, request them for yourself or someone you can request for, and submit the whole cart at once.