The change window is a cron line, and the shell doesn't exist outside it

Tuesday, 22:00. A cron entry fires: PATCH /api/v1/containers/{id}/proxy/permissions/permissions/oncall with {"terminal": [1]}. For the next hour, the on-call group's bearer token opens terminal 1 on the settlement box. At 23:00 a second entry fires: DELETE .../permissions/oncall/terminal. The cell is gone. The next request from the same token gets a 403 from the proxy, before anything inside the container hears it.

Nobody requested access. Nobody approved a request. The window was agreed in the change meeting and written down as two cron lines, and the proxy enforces the calendar. What happened inside the hour is in the terminal history, timestamped, ready for the ticket.

An access-request system needs a proxy, a certificate authority, an approval workflow, and a recording layer. Here, the approval is the schedule.

The change window is a cron line, and the shell doesn't exist outside it.