Abstract: A computer system that includes one or more processors configured to execute a secure sovereign manager that controls remote execution of commands on a sovereign cloud computing platform. The secure sovereign manager is configured to create an escorted session for an unqualified user for invoking commands on the sovereign cloud computing platform. The unqualified user does not have sovereign-trusted credentials that define qualifications required for accessing the sovereign cloud computing platform. The escorted session is asynchronously supervised by a qualified user that has sovereign-trusted credentials. The secure sovereign manager is configured to receive an indication of approval or denial of invocation of a received command. Based on at least receiving an indication of approval, the secure sovereign manager invokes the received command on the sovereign cloud computing platform.

Abstract: A computer system that includes one or more processors configured to execute a secure sovereign manager that controls remote execution of commands on a sovereign cloud computing platform. The secure sovereign manager is configured to create an escorted session for an unqualified user for invoking commands on the sovereign cloud computing platform. The unqualified user does not have sovereign-trusted credentials that define qualifications required for accessing the sovereign cloud computing platform. The escorted session is asynchronously supervised by a qualified user that has sovereign-trusted credentials. The secure sovereign manager is configured to receive an indication of approval or denial of invocation of a received command. Based on at least receiving an indication of approval, the secure sovereign manager invokes the received command on the sovereign cloud computing platform.

Abstract: A computer system that includes one or more processors configured to execute a secure sovereign manager that controls remote execution of commands on a sovereign cloud computing platform. The secure sovereign manager is configured to create an escorted session for an unqualified user for invoking commands on the sovereign cloud computing platform. The unqualified user does not have sovereign-trusted credentials that define qualifications required for accessing the sovereign cloud computing platform. The escorted session is asynchronously supervised by a qualified user that has sovereign-trusted credentials. The secure sovereign manager is configured to receive an indication of approval or denial of invocation of a received command. Based on at least receiving an indication of approval, the secure sovereign manager invokes the received command on the sovereign cloud computing platform.

Abstract: Methods, systems, and computer storage media for providing escorted-access management based on an escort-admin session engine are provided. The escort-admin session engine approves an external administrator's access to a resource instance based on a service team policy, while approving an escort operator to escort the external administrator in an escort-admin session that provides access to the resource. In operation, an external administrator's request for access to a resource is evaluated based on the service team policy that is managed by a service team. The request is approved with access rights to the resource identified in the policy. An escort operator is identified for the external administrator. The escort operator is approved to escort the external administrator for access to the resource during an escort-admin session. The escort-admin session includes an escort operator context referring to the escort operator having access rights based on the access rights approved using the policy.