IBM · Security · Filed Mar 18, 2025 · USPTO published Sep 24, 2026 · Sep 24 release

IBM Patents an AI That Grants and Revokes Developer Access While Bugs Get Fixed

Every time a developer fixes a bug, someone has to manually hand out access to the right systems and then remember to take it away. IBM's new patent hands that entire process to an AI.

By Patentlyze Team · Updated Sep 24, 2026 · 3 min read

An Access Manager interacts with AI models and data storage to manage permissions for bug fixing. Drawing from patent filing US 2026/0288929 A1. — An Access Manager interacts with AI models and data storage to manage permissions for bug fixing.All 11 drawings ↓

Publication number: US 2026/0288929 A1(US20260288929A1)
Applicant: INTERNATIONAL BUSINESS MACHINES CORPORATION
Filed · Published: Mar 18, 2025 · Sep 24, 2026
Inventors: Jin Xu, Chong Liu, Xu Lu, Xiao Kou, Qi Mao, Chao Li, A Long Zhi
Status when we published: Company responded; back with the examiner
Document: 20 claims
US classification: 726/21
Examiner: BHANDARI, SHREYAJ RAM (Art Unit 2434)

How IBM's AI handles access during software repairs

Imagine a plumber who needs a key to your building to fix a leak. Someone has to give them that key, make sure it only opens the right doors, and then collect it back when the job is done. In big software companies, this same drama plays out dozens of times a day with access to sensitive systems and data, and it's just as easy to forget the "collect it back" part.

IBM's patent describes an AI model that reads the description of a software bug and automatically figures out exactly which system access a developer (or an AI bug-fixing tool) needs to repair it. A human still approves the access, but once the fix is confirmed, the permissions disappear on their own.

The goal is to stop developers from accumulating standing access they shouldn't permanently hold. It keeps each repair contained to just the permissions actually needed, and removes those permissions the moment they're no longer necessary.

From the filing · CLAIM 1

… creating an access token to associate the one or more permissions with the bug; assigning the one or more permissions of the access token to a bug fixer; invoking the bug fixer to fix the bug; receiving an indication that the bug has been fixed; and revoking the one or more permissions from the bug fixer.

Translation: Temporary digital keys are given to the developer for the task and deleted once the bug is resolved.

How the AI reads bugs and issues temporary access tokens

The system starts when a bug report lands. The text of the bug description and any attached comments are fed into a permissions AI model (an AI trained to interpret what parts of a system a fix will likely require).

The AI returns a list of specific permissions: read access to a database table, write access to a configuration file, or the ability to invoke a particular service. A human reviewer then approves or adjusts that list before anything is granted.

Once approved, the system creates an access token (a digital credential, like a temporary badge) that bundles those permissions together and ties them specifically to that bug. The token is handed to the bug fixer, which can be a human developer or an automated tool.

The fixer works within those permissions to resolve the bug.
When the fix is confirmed, the system receives a signal that the bug is closed.
All permissions in the token are immediately revoked, with no manual step required.

The patent emphasizes that permissions never outlive the task they were created for, which is the core security property the whole approach is built around.

What this means for software teams and security audits

Software security teams call this the principle of least privilege: give people and systems only the access they need, for only as long as they need it. In practice, most organizations are bad at it. Developers accumulate access over time, forgotten credentials pile up, and a breach in one account can open far more doors than it should. A bug-driven, automatically expiring access system attacks that problem at the source.

For large enterprises running many developers or AI-assisted coding tools against sensitive systems, automated permission scoping could also reduce compliance overhead. Instead of manually documenting who had access to what and when, the token system produces that audit trail as a side effect of doing the work.

IBM's 56th filing we've tracked since May in the AI safety guardrails race builds on a two-layer fact-check idea and a response-rewriting system.

Editorial take

Forgotten access is one of the quieter ways organizations lose control of sensitive data. A developer gets permission to touch a critical system to fix a bug, the fix ships, and the permission stays active for weeks or months because revoking it manually falls through the cracks.

IBM's approach here matches the scale of that risk. An AI reads the bug description, proposes the narrowest access needed to fix it, a human approves it, and the permission disappears automatically once the fix is done. The security benefit depends almost entirely on how accurately the AI scopes that access, since an AI that consistently asks for too much or too little will be worked around rather than trusted.

At its best, this turns a process that currently relies on human memory and discipline into something automatic and auditable, which is exactly where the cost savings hide.

Source: US 2026/0288929 A1 at the USPTO (PDF). Full patent text and figures are in the official publication.

Get our take in your Top Stories

Liked this breakdown? Add Patentlyze as a preferred source on Google, and our plain-English take shows up more often in your Top Stories the next time IBM patent news breaks.

Add Patentlyze on Google One click.

There are more where this came from

We read every patent application Big Tech publishes and send you the ones worth knowing. Plain English, free, every week.