---
title: Elevate Policy Group
slug: kronpam-agent-reference-guide-3-8-0/elevate-policy-group
description: Learn how to configure child processes and just-in-time access for applications with our comprehensive document. Take control of which applications are allowed to call and execute child processes, and configure security measures for granting access to blo
docTags: 
createdAt: 2023-06-20T14:52:29.000Z
---

Under this policy with elevation configuration, when an end user attempts to launch an application included in the policy, a prompt will be triggered, requesting the user to set a time limit for its usage. The end user has the authority to determine the duration for which this application can be accessed. Once the elevation request is approved by the end user's manager, a temporary rule is generated specifically for that user.

This temporary rule remains active until the designated time limit expires. Upon reaching the expiration time, the temporary rule is automatically removed, revoking the elevated privileges previously granted to the user for that application. This mechanism ensures that elevated access is granted only for the required period, promoting security and control over privileged application usage.

::Image[]{src="https://api.archbee.com/api/optimize/g9cApVza9NIhSh0pjZYtA/0jr92vrt3rvglv45SAYWP_image.png" size="74" width="658" height="461" position="center" caption="Child Progress Config" showCaption="true"}

In this step, users will be configuring child processes. When an application is launched it may be required to run some child processes to make the application function. Since not every application requires this and it could be used as an attack vector, system admins can decide whether this application will be permitted to call and execute child processes or not. If this is not configured with care, it can prevent applications from running normally. 

::Image[]{src="https://api.archbee.com/api/optimize/g9cApVza9NIhSh0pjZYtA/nj-p6sUFcaWjALk43xTat_image.png" size="74" width="549" height="437" position="center" caption="Elevation Config" showCaption="true"}

In the last step, the user is expected to configure a just-in-time access configuration. When an agent blocks an application users can ask for an elevation to access the blocked application. Users can configure the required security steps to grant access to the user. This can be configured separately for admins and standard users. To get access depending on the configuration users can be asked for MFA and Managerial approval via email.