How Instacart Uses AI to Keep Doors Open and Risks Closed

Instacart's infrastructure security team set out to move employees from long-lived access to just-in-time access on its most critical systems, a goal tied to its preparation for going public and the audit obligations that came with it. The speakers found that manager approval was a weak control: requests were almost always approved, approvals were slow, and approvers often lacked the context to judge them. Without a faster process, employees kept standing access and the old habits returned.

Their answer was to pre-approve access based on attributes kept in Terraform, with time-limited grants that users could renew immediately if they matched. For roles where the eligibility rules were hard to write down, such as high-impact developer roles, they built Gadget, an open-source and pluggable tool. It asks an LLM to compare a requester's job title and organizational unit with those of people who already hold the entitlement, returns numeric similarity scores, and auto-approves when the combined score clears a threshold. Otherwise it leaves guidance for the approver. The speakers described validating scores by replaying three months of real requests, and they warned that model output can be invented, so results should be checked against the original inputs. They also demonstrated using an LLM to draft role descriptions from policy statements, submitted through a pull request for auditor evidence.

The main takeaway is that an LLM works well on gray-area context across large datasets, while humans still review its output and keep prompts simple and structured. Attendees who run similar access workflows, or who want to automate tedious security and audit tasks, would find practical patterns to adapt.