Hey everyone! I've been diving deep into CyberArk at my org, and while it's a powerhouse for PAM, there's one friction point I keep hearing about from our dev teams: the process for requesting new application IDs can feel like running an obstacle course 😅.
We've been iterating on our internal workflow to make this smoother, and I wanted to share what's worked for us and see how others are handling it. The goal is to balance security compliance with developer velocity—because if it's too slow, you risk shadow IT workarounds.
First, we created a self-service intake form (we use Jira Service Management, but any ticketing system works) that pre-populates a lot of the required fields CyberArk needs. This reduces back-and-forth. The form asks for the specific safe, the required permissions level, a brief justification, and links to the CI/CD pipeline or service account documentation.
Then, we automated the approval routing. Low-risk requests (like for a pre-approved dev environment safe) get auto-approved and go straight to the CyberArk admins via the REST API. Higher-risk requests ping the relevant application owner and security lead in Slack with a link to approve/reject quickly.
The real win was building a simple dashboard showing request status. Developers hate being in the dark, so they can now see exactly where their request is—whether it's "pending approval," "queued for provisioning," or "completed." This transparency cut down follow-up tickets by like 70%.
Has anyone else tackled this? I'm especially curious about:
- How you handle emergency/break-glass requests without bypassing the whole system.
- If you've integrated the request flow directly into your DevOps tools (like Terraform or Kubernetes operators).
- Any pitfalls you ran into with role-based access controls in the request process itself.
Love comparing notes on this stuff—every org's setup is a little different, and there's always a better way to streamline!