Managing access control using policy evaluation mode

A system comprising:

• one or more processors and non-transitory computer-readable media comprising instructions that, when executed by the one or more processors, cause operations comprising:
• receiving, from an identity, a request to access a resource by the identity;
• determining one or more access control policies that correspond to the access to the resource;
• identifying, from the one or more access control policies, (i) a first access control policy that is capable of operating in a policy evaluation mode that overrides an access-permission-revoking change to a control policy for a temporary time period and causes a pre-change version of the control policy to be in effect during the temporary time period,
• the policy evaluation mode being activated for the first access control policy, for a threshold amount of time to allow the identity to access the resource for the threshold amount of time, in response to a policy change to the first access control policy;
• determining a lack of further access control policy in a regular mode that allows the identity to access the resource;
• authorizing the request using the first access control policy in the policy evaluation mode based on determining the lack of further access control policy in the regular mode that allows the identity to access the resource;
• and
• in response to determining that a threshold time period has elapsed since a policy evaluation log has been generated for the resource, deleting the first access control policy that is operating in the policy evaluation mode.

A non-transitory computer-readable medium comprising instructions that, when executed by one or more hardware processors of a device, cause the device to perform operations comprising:

• receiving, from an identity, a request to access a resource by the identity;
• identifying, from one or more access control policies comprising a permission for the identity to access the resource, a first access control policy that is capable of operating in a policy evaluation mode that overrides an access-permission-revoking change to a control policy for a temporary time period and causes a pre-change version of the control policy to be in effect during the temporary time period,
• the policy evaluation mode being activated for the first access control policy, for a threshold amount of time to allow the identity to access the resource for the threshold amount of time, in response to a policy change to the first access control policy;
• determining a lack of further access control policy in a regular mode that allows the identity to access the resource;
• authorizing the request using the first access control policy in the policy evaluation mode based on determining the lack of further access control policy in the regular mode that allows the identity to access the resource;
• and
• in response to determining that a threshold time period has elapsed since a policy evaluation log has been generated for the resource, deleting the first access control policy that is operating in the policy evaluation mode.