What breaks when just-in-time access is only an approval workflow?

It stops being a privilege control and becomes a faster way to issue temporary standing access. If approval, activation, and revocation are not tightly coupled, the organisation still carries the same governance risks, just inside a shorter window. The control has to enforce expiry, not merely record intent.

When JIT Becomes Only an Approval Flow

Just-in-time access only works as a privilege control if the approval event actually causes time-bound activation and automatic expiry. Once the workflow only records permission to use access later, the organisation has moved from enforcement to paperwork. The result is usually shorter-lived standing access, not true just-in-time control.

That distinction matters because the control objective is not simply to authorise access, but to constrain how long elevated access can exist, how it is activated, and how it is revoked without relying on manual follow-through.

When the approval and the activation are decoupled, teams often keep a valid path to use the privilege beyond the intended task window. That can look compliant in the ticketing system while still leaving an exploitable access path in the target system.

What Actually Breaks in Governance and Enforcement

The first thing that breaks is the security guarantee. Approval alone cannot prove that privilege existed only for the needed duration, because the decision to approve is not the same as the control that enforces expiry. If the account remains active after the task, the access model is still standing privilege with a different front end.

The second break is accountability. A workflow may show who approved the request, but it does not by itself prove when the privilege became active, whether it was automatically disabled, or whether the user kept access after the approved window. Without those links, recertification and audit evidence become much weaker than the business process suggests.

The third break is operational. Manual activation and manual revocation create delay, and delay creates drift. The longer the gap between intent and enforcement, the more likely teams are to treat the approval as the control, rather than the expiry and revocation mechanics that make the control real.

For a tighter explanation of that boundary, NHIMG’s Just-in-Time Access and Zero Standing Privilege Guide covers time-bound access patterns, and the Privileged Access Management Guide explains how activation, session control, and expiry work together.

Why the Difference Matters for Security Architecture

Approval-only JIT shifts the control from the runtime layer to the process layer, and that changes the threat model. A ticket can be misrouted, delayed, reused, or approved for convenience, but a properly enforced JIT control can still prevent privilege from persisting after the approved task ends.

This is especially important for elevated admin access, cloud roles, and high-risk break-glass paths, where the impact of a lingering session or role assignment is much higher than the impact of the original request. Approval is a governance signal; expiry is the actual containment mechanism.

That is why expiry, activation, and session termination need to be coupled to the control itself. If the system cannot prove that the privilege stops when the window closes, then the architecture is relying on people to do the job of an automated guardrail.

For broader control design, the Cloud PAM and CIEM Guide is useful where cloud entitlements and effective permissions matter, and the Privileged Session Management Guide shows how session oversight complements access activation.

Risk and Threat Considerations

Approval-only JIT creates a common failure mode: the organisation believes it has reduced standing privilege, but the privileged path remains usable long after the approved task should have ended. That increases the blast radius of every approved request and makes delayed revocation, shared credentials, and reused access paths more dangerous.

Failure mechanism: The workflow records permission intent, but the target system does not enforce time-bound activation or automatic revocation, so access survives beyond the intended window.

Impact: Attackers, insiders, or simply careless users can keep using elevated access after the business reason has expired, which weakens least privilege and undermines auditability.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

NIST SP 800-53 Rev 5 sets the technical controls, while ISO/IEC 27001:2022 defines the regulatory obligations.

Framework	Control / Reference	Relevance
NIST SP 800-53 Rev 5	AC-2 — Account Management	JIT approval without enforced expiry is an account lifecycle control gap.
	IA-5 — Authenticator Management	Temporary access still depends on credentials that must expire or be revoked.
	AC-6 — Least Privilege	Approval-only access can leave excess privilege active beyond task need.
Recommendation — Bind activation and automatic disablement to the approved access window. Set credential expiry and revocation to match the access window. Limit privileges to the minimum scope and duration needed.
ISO/IEC 27001:2022	A.5.15 — Access control	The question is about whether access is truly constrained, not just approved.
	A.8.2 — Privileged access rights	Privileged access must be granted and withdrawn on a controlled time basis.
Recommendation — Require technical enforcement of approved access boundaries. Manage privileged access with time-bounded activation and removal.

Practitioner Guidance

What to verify: Check that approval triggers activation, that activation has a hard expiry, and that revocation is automatic rather than dependent on a later human action. If you cannot evidence those three links, do not describe the control as JIT.

Decision rule: If the control only changes who may request access, it is governance workflow; if it changes whether privilege exists at runtime, it is a privilege control. Treat any approval-only design as temporary standing access until proven otherwise.

Practitioner takeaway: The control boundary is not the approval ticket, it is the enforced lifetime of the privilege. If the lifetime is not technically bounded, the “JIT” label is mostly a process description.