Comparison
Just-in-time access tools compared
Covers C1 (formerly ConductorOne), Opal, Lumos, Apono, Teleport and StrongDM (now part of Delinea), plus where TemprBac sits among them.
Six products that all say "just-in-time access" do three different jobs. Pick the job first; the shortlist follows from it.
A just-in-time access tool grants access when someone asks for it, for a bounded time, and removes it automatically afterwards. The tools differ in what they grant — a session through a proxy, a permission created for the task, or a membership in an existing group or app — and that difference decides which one fits far more than any feature checklist does.
Three jobs that share one name
| Job | What is granted | Products |
|---|---|---|
| Infrastructure access gateway | A session to a server, database or cluster, brokered through the product's proxy with short-lived credentials | Teleport, StrongDM |
| Ephemeral permissions | A permission created in the target system for the task — a database grant, a cloud role, a Kubernetes binding — and deleted afterwards | Apono |
| Access governance with requests | Membership of an app, group or entitlement, requested from a catalog, alongside access reviews and joiner-mover-leaver automation | C1, Opal, Lumos |
TemprBac sits closest to the third row and deliberately narrower: it grants time-bound membership of existing directory groups, and does not do reviews campaigns or lifecycle automation. More on that below.
The six, as their makers describe them
| Product | What it does, in its maker's words | Price published? | Changed recently |
|---|---|---|---|
| C1 | "App self service and policy controlled requests, JIT access", plus access reviews and workforce lifecycle | No — "exact pricing scoped with you" | ConductorOne's site now redirects to c1.ai |
| Opal | A "self-service catalog for employees to request access", and automated user access reviews | No — contact sales | — |
| Lumos | An AppStore for "self-service app requests in one place", access reviews and joiner-mover-leaver automation | No — demo | — |
| Apono | "Just-in-time access to humans, machines, and AI agents, then revokes it automatically" across databases, Kubernetes and cloud | No — free trial, then sales | — |
| Teleport | Infrastructure access for SSH, Kubernetes and databases, deployable "on-premises, in the cloud, or in a hybrid environment" | Usage-based, by active users and resources; no list price | Community Edition is under a commercial license from v16: free for companies under 100 employees and $10M revenue |
| StrongDM | Runtime just-in-time authorization to databases, servers, Kubernetes and cloud; "single SKU, per-user pricing" | No list price | Acquired by Delinea, completed March 2026 |
Quotes are from each product's own pricing or documentation pages. Where a maker does not describe something, the table does not guess.
How to pick by the job
Your engineers need shell and database sessions, recorded
That is a gateway. Teleport and StrongDM put a proxy between people and infrastructure, issue short-lived credentials, and record the session for replay. If an auditor needs to see what was typed on a production host, this row is the answer and the others are not. The cost is that every connection now depends on the proxy, and every system has to be reachable through it.
You want permissions that do not exist until someone asks
That is ephemeral permissions. Apono creates the grant in the target — a database role, a cloud permission — and deletes it afterwards, so between requests there is nothing to find. It is the most literal form of zero standing privilege, and it needs a connector with rights to create and delete permissions in each system it covers.
You need requests, reviews and onboarding in one place
That is access governance. C1, Opal and Lumos combine a request catalog with access reviews and lifecycle automation, which is what a compliance program wants in one system. They cover the most ground, and they are the most to roll out.
You need standing admin gone, across the IdP, GitHub and the cloud, this quarter
That is the case TemprBac is built for. It grants time-bound membership of the groups you already use — in Entra ID, Okta, Google Workspace, GitHub, AWS IAM and Active Directory — and removes it when the window closes. Because cloud RBAC, GitHub teams and SaaS apps already authorize by group, one expiry covers all of them, with nothing to proxy and no permissions to create. The Entra comparison covers why group-based access scopes as finely as per-resource elevation.
Where TemprBac is not the answer
- Session recording or a proxy in front of hosts — that is the gateway row.
- Per-request database credentials — that is the ephemeral row.
- Access review campaigns and joiner-mover-leaver automation — the governance row. TemprBac records every grant and removal, which makes a user access review smaller, but it does not run one.
The two questions to ask every vendor
- "What stops revocation?" Ask what happens to a live grant if the license lapses, a quota is hit, or the connector loses its credential. If anything other than "nothing" is the answer, a temporary grant can become a permanent one without anyone noticing. The just-in-time guide explains why this is the half that decides whether any of it worked.
- "What does it cost for our team?" None of these six publishes a list price, which is normal in this category. Get the number in writing before the trial, including what happens at renewal.
How TemprBac fits
TemprBac publishes its price on the pricing page, includes single sign-on on every tier, runs hosted or self-hosted, and treats revocation as an invariant: no plan limit, quota or billing state can stop access from expiring. It is the narrowest product on this page, on purpose.