Application links that activate already-approved browser access and continue to the app

What problem would you like Teleport to solve? For an HTTP application requiring a requestable role, users report that approval does not automatically activate access in their browser. They must open Access Requests, find the approved request, click Assume Roles, and then navigate to the application. Assuming the request in Teleport Connect or tsh does not activate the browser session. Launching the application from Connect therefore leaves the same browser activation steps.

What would you like Teleport to do? Provide a stable, app-specific Teleport link that users can bookmark or share. Opening it should:

• Authenticate the user if necessary, preserving the intended application.
• Continue directly if the browser session already has access.
• Otherwise, find the authenticated user’s valid, approved requests that would authorize access to that application.
• Offer Activate access and continue inline when confirmation is required, with inline selection if multiple requests qualify.
• Activate the selected request in the browser and automatically continue to the application.
• If no request qualifies, provide a clear path to request access where policy permits, preserving the application destination. Otherwise, clearly explain that access cannot be requested. Users should not need to visit the general Access Requests page or return to the resource list. The link should remain reusable across sessions and successive access requests, without depending on a particular request ID.

Security and acceptance criteria Preserve existing approval requirements, request ownership, scope, validity windows, expiration, authentication requirements, and audit logging. Revalidate eligibility when activating access and authorize the application before continuing. Sharing the link must not transfer access. If activation assumes a role granting access beyond the target application, the confirmation should make that scope clear. This request streamlines activation of already-approved access; it does not request standing access or bypass approval.