HubSpot Rebuilds JITA System With Rule Engine to Improve Access Decision Transparency

HubSpot has overhauled its Just-In-Time Access authorization system, replacing complex conditional logic with a rule engine architecture built around a directed acyclic graph. The redesigned system processes roughly 5,500 daily access requests across HubSpot's 10,000-person workforce, evaluating each request through independent, auditable rules. A key motivation was improving explainability — engineers previously struggled to determine why a request was approved or denied and which checks were slowing down processing. The new architecture captures structured output per rule, including execution timing and metadata, enabling granular observability at the individual policy level. HubSpot validated the migration by running the legacy and new systems in parallel before fully switching production traffic to the updated implementation.