Skip to main content

​
What Is the Employee AppStore?

The Employee AppStore is where employees find the apps and permissions they need, request them, and follow each request to completion. Employees describe what they need in plain language, or browse the catalog and use the standard request form. With the Access Request Agent on, employees can say what they’re trying to do, for example “I need Salesforce access to update customer accounts”, and the agent will:
  • Recommend the right app and permission (policy-bound and least-privilege)
  • Ask a targeted follow-up question when the request is ambiguous
  • Draft a clear business justification
  • Show a request preview that the employee reviews before submitting
The agent does not grant access. Existing Lumos policies and approval workflows still apply, and the employee must submit the request. The agent runs on your existing AppStore configuration. You don’t need to set up new policies.

​
Problems the Employee AppStore Addresses

  • Employees have trouble finding what they need. Catalog names and permission names don’t match how people describe their work.
  • Employees submit requests without the information approvers need. Approvers send requests back, and the clock restarts.
  • Over-privileged access is a security risk. When employees can’t tell which permission fits, they pick the broadest one.

​
Outcomes the Employee AppStore Enables

  • Employees get access faster. Employees spend less time searching the catalog and less time getting to a submitted request.
  • Less wasted effort. Requests arrive with the information approvers need, so there is less back and forth before approval.
  • Less over-privilege. The agent recommends the narrowest permission that fits the task, so requests for unlimited access become rarer. Least privilege is the default path.

​
How Employees Request Access

​
Step 1: Open the Employee AppStore

Employees open the Employee AppStore on the web. If the Access Request Agent is on for your organization, the agent appears in the AppStore. If your organization uses Lumos MCP, employees can also start from a compatible AI assistant (see Request Access from AI Assistants).

​
Step 2: Describe what you need

Use plain language. Good requests include:
  • The app, if you know it
  • What you’re trying to do (task or outcome)
  • Relevant context such as team, project, or urgency
Examples:
  • “I need Jira access to comment on tickets for the Mobile team.”
  • “I need to view Q1 campaign performance metrics. What tool should I use?”
  • “I need Snowflake access for reporting for the next 30 days.”

​
Step 3: Answer clarifying questions

If the request is ambiguous, the agent may ask one follow-up question to narrow the scope, for example view versus edit.

​
Step 4: Review the request preview

Before you submit, you see a preview with the app, permission, duration, and business justification.

​
Step 5: Submit from the request form

The recommendation opens the request form prefilled. Change anything you need, then submit.

​
Track Every Request in My Requests

The My Requests view shows where each request stands, who is acting on it, and who to contact if access is delayed. For each request, employees can see:
  • Status. The stage the request is in, such as pending approval, provisioning, completed, or denied.
  • Who is approving. The approvers for the current approval stage.
  • Who is provisioning. The person or team completing the access after approval, such as the app admin or the assignee of a manual provisioning task.
  • Who to contact. If no approver or assignee is set, My Requests says so and points the employee to IT.

​
Turn the Access Request Agent On or Off

The Access Request Agent is a per-organization setting in the Employee AppStore.
  • New customers: the agent is on by default.
  • Existing customers: the agent is on if your organization already had it before this setting existed. Every other existing organization starts with it off, and an admin turns it on.
To change the setting:
  1. In Lumos, go to Settings > AppStore Settings.
  2. Find Enable Access Request Agent in the Employee App Store.
  3. Turn it on or off.
When the agent is off:
  • The agent is hidden in the Employee AppStore.
  • Employees request access through the standard AppStore flow: browse the catalog, pick an app and permission, and complete the request form.
  • My Requests keeps working, and existing requests and approvals aren’t affected.
This setting applies to the Employee AppStore only. It does not affect Slack, Jira Service Management, or requests made from MCP-compatible AI assistants. Slack and Jira Service Management are set up separately: see Access Request Agent Support in Slack and Adding the Lumos Access Request Agent to Jira Service Management.

​
Improve Agent Recommendations with Knowledge Hub

Knowledge Hub lets you give the Access Request Agent context about your organization, so it maps what an employee asks for to the right app, permission, and duration. You can add context at three levels:
  • Per app: what the app is used for, who typically needs it, and the permissions and durations available.
  • Per permission: guidance for apps with many entitlements, so the agent asks the right questions up front.
  • Per tenant: organization-wide rules, such as “all time-based apps require a justification.”
For setup steps, example context, and a checklist to test the agent’s responses, see Knowledge Hub: AppStore.

​
Request Access from AI Assistants

If you use Lumos MCP, employees can run access workflows from approved AI assistants and developer tools such as Claude, Claude Code, Codex, Gemini CLI, and OpenCode. Employees can:
  • Search available applications and permissions
  • Find least-privilege access options
  • Draft or submit access requests
  • Check the status of recent requests
Examples:
  • “Find the least-privilege Salesforce access that lets me create reports.”
  • “Request Snowflake access for 30 days for Q3 reporting work.”
  • “Show my recent AppStore access requests.”
Every request still follows your Lumos policies, approvals, scopes, and authorization controls. To set up an MCP-compatible client, see the Lumos MCP Getting Started Guide.