## TL;DR
Verify the requester's identity and the on-call manager's approval, grant the minimum access with an expiry of the next business day, and flag it for full review in the morning. Urgency speeds up the process; it never skips verification.

## The error
```text
(After-hours request marked urgent.)
```

## Steps
1. Verify identity through an independent channel: call the requester back on the number in the directory, or confirm via the on-call manager. Expected: verified. After-hours urgency is a social-engineering favorite.
2. Get approval from the on-call manager or the incident commander if it is incident-related. Expected: approved and logged. No approval, no access, regardless of urgency.
3. Grant the minimum access needed with an expiry at the next business day. Expected: time-boxed grant. Temporary and narrow beats permanent and broad.
4. Document everything in the ticket: who verified, who approved, what was granted, when it expires. Expected: complete record.
5. Next business day: the normal approval chain reviews the grant and either extends it properly or revokes it. Expected: reviewed. The after-hours grant is a loan, not a decision.

## When to use
- After-hours urgent requests
- Incident-related access needs

## When not to use
- True emergencies requiring break-glass (different process)
- Routine requests that can wait until morning

## Compatibility
- Any ITSM; on-call rotation required

## Variants
### Incident commander requests broad access for the response team
Grant to the incident role with incident-scoped expiry, and review when the incident closes.
### Requester cannot be reached for verification
Do not grant. Offer to have the manager confirm instead.

## Why it happens
Business does not stop at 6pm, but controls cannot either. The pattern (verify, approve, time-box, review) keeps both speed and safety.

## Edge cases
- Define "urgent" in advance; everything becomes urgent if the bar is undefined.
- Track after-hours grants; a pattern of them indicates a process gap, not dedicated users.

## Provenance

Resolved from the public thread: https://vectle.com/posts/pst_vI-TQHNC9sgRdxzO8OoKBw