Building an AI Agent That Manages Your Team's Access Control

Building an AI Agent That Manages Your Team's Access Control

Managing team access to your Deployxa apps is tedious: when a new team member joins, you need to add them to the right apps with the right permissions; when a team member leaves, you need to remove their access; and you need to periodically audit who has access to what. Manual access management is error-prone (you might forget to remove access for a departed team member) and does not scale. What you need is an AI agent that manages team access automatically: adds new members, removes departed members, manages permissions, and audits access. With the Deployxa MCP server, this is straightforward to build. Here is how.

The direct answer is that an access control agent is a script that manages team members' access to your Deployxa apps: it adds new members (via deployxa_invite_team_member), removes departed members (via deployxa_remove_team_member), manages permissions (via deployxa_update_team_member_role), and audits access (via deployxa_list_team_members). The agent can integrate with your HR system (e.g., to detect when a team member joins or leaves) and with Slack (e.g., to receive access requests). For more on security, see our article on securing agentic cloud deployments.

Why Manual Access Management Is Dangerous

Three problems make manual access management dangerous. First, it is error-prone. A team member might be given too much access (e.g., admin instead of read-only), or a departed team member's access might not be revoked. Second, it does not scale. For teams with many members and many apps, managing access manually is a full-time job. Third, it is not auditable. Without an audit trail, you cannot prove who had access to what and when, which is essential for compliance. An AI agent solves all three problems: it manages access consistently (no human error), it scales to any number of members and apps, and it logs all changes (for auditability). For more on agentic patterns, see our article on building a custom AI deployment assistant.

What the Access Control Agent Does

The access control agent performs the following tasks:

1. Sync with HR system. The agent syncs with your HR system (e.g., to detect when a team member joins or leaves).

1. Add new members. When a new team member joins, the agent adds them to the appropriate apps with the appropriate role (e.g., developer, viewer, admin).

1. Remove departed members. When a team member leaves, the agent removes their access from all apps.

1. Manage permissions. The agent can update a team member's role (e.g., promote from developer to admin) based on HR changes.

1. Audit access. The agent periodically audits who has access to what, and flags any anomalies (e.g., a team member with admin access who should not have it).

1. Handle access requests. The agent can handle access requests from Slack (e.g., a team member requests access to an app, and the agent grants it if the request is approved).

Step-by-Step: Building the Access Control Agent

Here is how to build the access control agent in Python, using the Deployxa MCP server.

Step 1: Install dependencies

pip install openai requests schedule
npm install -g @deployxa/mcp-server
deployxa-mcp login

Step 2: Create the agent script

# access_agent.py
import requests
import schedule
import time
import json
from datetime import datetime

SLACK_WEBHOOK_URL = "https://hooks.slack.com/services/..."
DEPLOYXA_MCP_URL = "http://localhost:3000/mcp"
HR_API_URL = "https://api.your-hr-system.com"
HR_API_KEY = "your-hr-api-key"

def call_deployxa(tool, params):
    response = requests.post(DEPLOYXA_MCP_URL, json={"tool": tool, "params": params})
    return response.json()

def send_slack_notification(message, is_alert=False):
    emoji = "👥" if not is_alert else "🚨"
    requests.post(SLACK_WEBHOOK_URL, json={"text": f"{emoji} {message}"})

def get_hr_team_members():
    """Get the current team members from the HR system."""
    response = requests.get(
        f"{HR_API_URL}/team-members",
        headers={"Authorization": f"Bearer {HR_API_KEY}"},
    )
    return response.json().get("members", [])

def get_deployxa_team_members():
    """Get the current team members from Deployxa."""
    result = call_deployxa("deployxa_list_team_members", {})
    return result.get("members", [])

def add_team_member(email, role, app_ids):
    """Add a team member to Deployxa."""
    for app_id in app_ids:
        result = call_deployxa("deployxa_invite_team_member", {
            "app_id": app_id,
            "email": email,
            "role": role,
        })
    return True

def remove_team_member(member_id, app_ids):
    """Remove a team member from Deployxa."""
    for app_id in app_ids:
        result = call_deployxa("deployxa_remove_team_member", {
            "app_id": app_id,
            "member_id": member_id,
        })
    return True

def sync_team_members():
    """Sync team members between HR system and Deployxa."""
    print(f"[{datetime.utcnow().isoformat()}] Syncing team members...")
    
    hr_members = get_hr_team_members()
    deployxa_members = get_deployxa_team_members()
    
    hr_emails = {m["email"] for m in hr_members if m["status"] == "active"}
    deployxa_emails = {m["email"] for m in deployxa_members}
    
    # Add new members (in HR but not in Deployxa)
    new_members = hr_emails - deployxa_emails
    for email in new_members:
        hr_member = next(m for m in hr_members if m["email"] == email)
        role = "developer" if hr_member["role"] == "engineer" else "viewer"
        app_ids = ["123", "124"]  # All app IDs
        add_team_member(email, role, app_ids)
        send_slack_notification(f"Added team member: {email} (role: {role})")
        print(f"  Added: {email}")
    
    # Remove departed members (in Deployxa but not in HR)
    departed_members = deployxa_emails - hr_emails
    for email in departed_members:
        deployxa_member = next(m for m in deployxa_members if m["email"] == email)
        app_ids = ["123", "124"]
        remove_team_member(deployxa_member["id"], app_ids)
        send_slack_notification(f"Removed team member: {email}", is_alert=True)
        print(f"  Removed: {email}")
    
    if not new_members and not departed_members:
        print("  No changes needed")

def audit_access():
    """Audit who has access to what."""
    print(f"[{datetime.utcnow().isoformat()}] Auditing access...")
    
    members = get_deployxa_team_members()
    
    # Flag members with admin access
    admins = [m for m in members if m.get("role") == "admin"]
    
    if len(admins) > 3:
        send_slack_notification(
            f"Access audit: {len(admins)} members have admin access. "
            f"Review if all are necessary: {', '.join(m['email'] for m in admins)}",
            is_alert=True
        )
    
    print(f"  {len(members)} members, {len(admins)} admins")

# Schedule sync (daily) and audit (weekly)
schedule.every(1).days.do(sync_team_members)
schedule.every(7).days.do(audit_access)

# Run immediately, then on schedule
sync_team_members()
audit_access()
while True:
    schedule.run_pending()
    time.sleep(1)

Step 3: Run the agent

python access_agent.py

The agent runs immediately, then syncs daily and audits weekly. It adds new members, removes departed members, and flags access anomalies.

Common Pitfalls and Troubleshooting

The first pitfall is not testing in staging. Auto-adding or auto-removing team members in production without testing is risky, because a bug could lock everyone out or give unauthorized access. The fix is to test the agent in staging first. The second pitfall is not having a fallback. If the agent goes down, access changes are not made, which means new team members cannot access the app and departed team members retain access. The fix is to monitor the agent and to have a manual fallback. The third pitfall is not requiring approval for role changes. Auto-promoting a team member to admin is risky, because admin access is powerful. The fix is to require approval (e.g., from a manager) for role changes, especially promotions to admin. The fourth pitfall is not auditing regularly. Without regular audits, access accumulates (team members gain access over time and never lose it), which creates a security risk. The fix is to audit access regularly (e.g., weekly) and to flag anomalies. The fifth pitfall is not logging access changes. Without logging, you cannot prove who had access to what and when, which is essential for compliance. The fix is to log all access changes (via the Deployxa audit log). For more on audit logs, see our article on the audit log system.

Conclusion: Let the Agent Manage Access

Manual access management is error-prone, does not scale, and is not auditable. An AI agent that manages team access automatically is the sustainable solution. With the Deployxa MCP server and your HR system, you can build an access control agent that keeps access in sync and audited. Stop managing access manually and start automating.

Ready to build your access control agent? Install the Deployxa MCP server with npm i -g @deployxa/mcp-server, run deployxa-mcp login, and start building. For more on agentic workflows, see our articles on the agentic performance testing pipeline and building an AI agent that generates documentation. Learn about the agentic security scanning pipeline and building an AI agent that manages SSL certificates in our companion articles. Explore our free developer tools to speed up your workflow.