Run-time authorization is an access model that grants permissions only when a task is actively being performed. Instead of keeping rights permanently assigned, the control evaluates the request, approves the minimum needed access, and removes it after use. This reduces standing privilege and fits dynamic human and machine workflows.
Expanded Definition
Run-time authorization is the practice of deciding access at the moment a task is executed, rather than assigning broad permissions in advance. In NHI security, it is most useful when an agent, service account, or workflow needs narrowly scoped access for a specific action, then should lose that access immediately after completion.
This model differs from static role assignment because the decision is tied to context such as task identity, requested resource, time window, and policy conditions. It aligns closely with Zero Standing Privilege and with the broader direction of NIST SP 800-53 Rev 5 Security and Privacy Controls, where access should be limited, reviewed, and enforced according to mission need. Definitions vary across vendors on whether run-time authorization is a policy engine, a workflow step, or a privilege elevation pattern, so teams should treat the term operationally rather than as a single product feature.
The most common misapplication is treating a standing role with periodic review as run-time authorization, which occurs when permissions remain continuously active between tasks.
Examples and Use Cases
Implementing run-time authorization rigorously often introduces orchestration overhead, requiring organisations to weigh reduced privilege exposure against additional policy checks and workflow latency.
- An AI agent requests database access only after a human-approved ticket is opened, and the credential expires when the task closes.
- A CI/CD job receives a short-lived token to deploy a release, but only after policy validates the repository, branch, and environment.
- A service account is granted permission to rotate a secret during a maintenance window, then is revoked automatically when the rotation finishes.
- A privileged automation workflow uses just-in-time access for a remediation action, with approvals logged for audit and rollback.
- Security teams compare this pattern with guidance in the Ultimate Guide to NHIs, especially where service accounts and API keys need tighter lifecycle control.
In standards-based architectures, runtime checks should be designed so that the decision point and the enforcement point are both visible to logging and governance, not buried inside application logic.
Why It Matters in NHI Security
Run-time authorization matters because NHI compromise usually becomes severe when access is both persistent and overbroad. NHIMG research shows that 97% of NHIs carry excessive privileges, and 80% of identity breaches involved compromised non-human identities such as service accounts and API keys. That combination means a stolen credential can stay useful far longer than intended.
When organizations use run-time authorization correctly, they reduce the blast radius of compromised automation, limit tool misuse by agents, and make secret exposure less valuable to an attacker. It also supports better alignment with the control intent described in Ultimate Guide to NHIs, where lifecycle discipline, revocation, and visibility are recurring themes. The principle also maps well to NIST SP 800-53 Rev 5 Security and Privacy Controls because access enforcement should be bounded by need and continuously accountable.
Organisations typically encounter the consequences only after a service account is abused or an agent is over-permissioned, at which point run-time authorization becomes operationally unavoidable to address.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 address the attack and risk surface, while NIST CSF 2.0 and NIST Zero Trust (SP 800-207) set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-02 | Run-time authorization limits persistent privilege, which is central to NHI access control. |
| NIST CSF 2.0 | PR.AC-4 | The term supports least-privilege access enforcement and timely permission management. |
| NIST Zero Trust (SP 800-207) | SC-2 | Zero Trust requires continuous evaluation, which matches run-time authorization decisions. |
Enforce task-bounded access and review entitlements so permissions never exceed current need.
Related resources from NHI Mgmt Group
- When should organisations move from one-time login checks to continuous authorization?
- What is the difference between continuous authorization and login-time authentication for AI agents?
- What breaks when authorization is decided only at login or provisioning time?
- Why does in-house authorization become more expensive over time?
