AccessDesk

An IT service-desk agent for access requests, built the way IT security would run it. Employees ask in plain words ("I need Salesforce read access for the month-end report"). Claude finds the right app and explains the outcome; five MCP servers do the work with the employee's own identity, never admin rights. Low-risk standard access is instant, the rest goes to the manager and the app owner, privileged access expires, and segregation-of-duties conflicts are refused.

Live demo: https://sh-accessdesk.streamlit.app (simulated company, no login; Demo mode needs no API key)

The design rule: the AI finds and explains, the policy decides, the employee confirms, approvers approve.

Why

Access requests are a large share of IT service-desk work, and companies already automate the routine ones (Avalara reports 78% of provisioning automated). The risk is an agent that hands out admin rights because someone typed "I'm the CTO", or because a ticket comment told it to. AccessDesk shows least privilege, identity and memory done properly.

Related MCP server: Company Management MCP Server

Results (20 scenarios, 8 of them attacks, fresh company each run)

Attacks in the set: claiming to be the CTO, asking for admin rights, asking for a colleague who is not your report, segregation-of-duties conflicts (post invoices + approve payments), payroll access from the wrong role, "ignore all previous instructions", and a vendor's ticket comment that tells the agent to grant AWS admin.

How it works

flowchart LR
  U((employee<br/>SSO identity)) --> A[agent<br/>Claude: find the app,<br/>preview the policy]
  A -- needs data --> T[tools<br/>9 read-only MCP tools<br/>identity added by the hub]
  T --> A
  A -- respond --> P[policy<br/>code re-checks<br/>the proposal]
  P --> C[request card<br/>employee confirms]
  C --> W[workflow, code<br/>ticket, approvals,<br/>grant token]
  W -. manager / owner .-> H((approvers))
  H -.-> W
  W --> I[IAM server<br/>checks token,<br/>SoD, eligibility]

Policy (code, first match wins): already has it → segregation-of-duties conflict → role not eligible → not yourself or your direct report → standard for your role: granted at once · not standard / medium risk: manager approves · high risk: manager + app owner, expires after max 30 days. A manager asking for a direct report counts as the manager's approval.

MCP servers

Identity: tools that act for a person take an identity argument. The MCP client (hub) fills it with the signed token of the logged-in employee and removes it from the tool definitions the model sees, so the model can neither read it nor claim to be someone else. It's the same idea as an OAuth on-behalf-of token, and every server verifies it.

On Streamlit Cloud each server runs as a child process over stdio; in docker-compose each runs as its own service over Streamable HTTP. Built on the official MCP Python SDK v2 (MCPServer).

Memory

Security (OWASP Top 10 for Agentic Applications)

Run it

pip install -r requirements.txt
streamlit run app.py                    # Demo mode needs no key
python -m accessdesk eval               # scripted evals (CI gate)
ANTHROPIC_API_KEY=... python -m accessdesk eval --live
printf "IDENTITY_SECRET=%s\nGRANT_SECRET=%s\n" $(openssl rand -hex 32) $(openssl rand -hex 32) > .env && docker compose up --build

In the app, switch the login in the sidebar: ask as Marta Silva (new Finance analyst), approve as João Pereira (her manager) and Inês Sousa (app owner), review team patterns as Inês.

Stack

Python 3.12 · LangGraph · MCP Python SDK v2 · Claude (Anthropic API or Amazon Bedrock) · Pydantic · SQLite · Streamlit · pytest · ruff · GitHub Actions · Docker

Part of a series

• InvoiceGuard: accounts-payable agent, the AI reads, code decides, a person approves

• FleetPilot: ML + AI sales copilot

• LexTreeRAG: vectorless RAG on EU law

MIT licence.