Work session lifecycle
For the actions available in a session, see Use a session. For duration settings, see Defaults and limits.
Session lifecycle
A session has one of eight statuses. Its detail page shows the current status. Once a session is closed, open History to review its recorded activity. The audit session detail uses the same tabs; its initial tab depends on the session status and plan.
A request admitted without review skips Pending. It starts at Approved if scheduled for later, or Active if it can start immediately.
Approval with no future start time: straight to Active
- Pending
An approver approves a scheduled request
- RejectedAn approver rejects it
- CancelledThe requester or a Superuser cancels it, or it is cancelled automatically before approval
- Approved
Its start time arrives, or an authorized user activates it early
- RevokedA Superuser revokes it, or its assignee is removed from the workspace
- ExpiredIts end time passes before it starts
- Active
An authorized user ends the session
- RevokedA Superuser revokes it, or its assignee is removed from the workspace
- ExpiredIts end time passes
- Completed
Statuses
| Status | Meaning | What you can do |
|---|---|---|
| Pending | Waiting for an approver; access is not available. | Wait for review, or cancel if you created the request or are a Superuser. |
| Approved | Approved with a scheduled start. | Wait for activation, or activate early if you can manage the session. |
| Active | The session grants access within its scope and time window. | Launch features, run commands, request an extension, or end the session. |
| Completed | A user with permission to manage the session ended it. | Review its history; request another session to continue. |
| Expired | Its end time passed. | Request another session. An expired session cannot be extended. |
| Rejected | An approver rejected the request. | Ask the approver about the decision before submitting another request. |
| Cancelled | Cancelled by the requester or a Superuser, or automatically before approval. | Submit another request if access is still needed. |
| Revoked | A Superuser revoked it, or its assignee was removed from the workspace. | Ask an administrator before requesting access again. |
Completed, Expired, Rejected, Cancelled, and Revoked are final statuses. None can return to Active.
Transitions and who can trigger them
The approvers are the people your access rules name, with Superusers as the default. Permission to manage a session belongs to its assignee, the owner of its assigned API token, the owner of the application holding its service token, and Superusers.
| From | To | Trigger | Who |
|---|---|---|---|
| Request submission | Approved or Active | Admission without review; Approved for a future start, Active otherwise | Automatic, according to access rules and execution control |
| Pending | Approved | Approval with a future start time | An approver |
| Pending | Active | Approval without a future start time | An approver |
| Pending | Rejected | Rejection | An approver |
| Pending | Cancelled | Cancel request or work-session cancel | The requester or a Superuser; being the assignee alone does not allow cancellation |
| Pending | Cancelled | The request lapses before review, or its requested end time passes | Automatic |
| Approved | Active | The scheduled start time arrives | Automatic |
| Approved | Active | work-session activate, including before the scheduled start | Anyone with permission to manage the session |
| Active | Completed | End session, Complete session in Live activity, or work-session complete | Anyone with permission to manage the session |
| Approved or Active | Revoked | work-session revoke; the session page offers Revoke only while Approved | A Superuser |
| Approved or Active | Revoked | The assignee is removed from the workspace | Automatic |
| Approved | Expired | The end time passes before activation | Automatic |
| Active | Expired | The end time passes | Automatic |
When a session completes, expires, or is revoked, its web terminals, file transfers, port forwarding, and editors close. Commands not yet delivered are cancelled, the session’s sudo permissions end, and pending feature changes and extension requests are cancelled. Review the recorded activity in Session history.