Abstract: Example aspects include techniques for providing an auditable mechanism for internal services to transact on tenant entities. These techniques may include receiving, from an internal service, by an assistant service, a service request to perform a cloud computing action over tenant data of a tenant of a cloud computing environment. In addition, the techniques may include identifying, by the assistant service, an existing principal of the assistant service within the tenant and possession of an existing permission associated with performing the cloud computing action within the tenant of the cloud computing environment. Further, the techniques may include performing the cloud computing action on behalf of the internal service based on identifying the existing principal and possession of the existing permission.

Abstract: Example aspects include techniques for providing a compliant and auditable approach for a user to perform an action without sufficient privileges. These techniques may include receiving, from a first user account, a first request to perform an action and determining that the first user account does not have permission to perform the action. In addition, the techniques may include identifying a second user account having permission to perform the action and transmitting, to the second user account, a second request for approval to perform the action. Further, the techniques may include performing in response to approval of the second request, the action without providing the permission to the first user account.