A security posture where no identity — human or non-human — holds persistent access rights. Access is provisioned dynamically on demand and automatically revoked after use. ZSP is the gold standard for NHI access control.
Expanded Definition
Zero Standing Privileges, or ZSP, means no identity is granted persistent access by default. Instead, access is issued only when a task is approved, constrained to the minimum scope needed, and removed immediately after use. In NHI security, ZSP is the practical expression of least privilege for service accounts, API keys, bots, and autonomous agents.
Definitions vary across vendors when ZSP is discussed alongside Privileged Access Management, just-in-time access, and Zero Trust Architecture, but the operational intent is consistent: reduce the time window in which any NHI can be abused. NIST SP 800-207 frames access as continuously evaluated rather than permanently trusted, which makes ZSP a natural control pattern for modern workload identity designs. When implemented well, ZSP limits lateral movement, narrows blast radius, and forces every privileged action to be accountable.
The most common misapplication is treating a dormant account with broad rights as compliant simply because it is rotated or vaulted, which occurs when standing privilege has been hidden rather than removed.
Examples and Use Cases
Implementing ZSP rigorously often introduces latency and orchestration overhead, requiring organisations to weigh faster automation against tighter control and approval workflows.
- A CI/CD pipeline requests production database access only during deployment, then drops the grant once validation completes, instead of reusing a long-lived service account.
- An AI agent gets a narrow, time-bound token to read a ticket, fetch a file, or call an API, with guardrails aligned to its current task and revoked when the workflow ends.
- A cloud admin session is brokered through PAM with approval and session recording, while the underlying NHI has no permanent standing permission to elevate itself.
- A third-party integration is issued ephemeral credentials for a maintenance window, reducing exposure in line with lessons from the Ultimate Guide to NHIs — Key Challenges and Risks.
- A workload identity is bound to a specific service and trust boundary, reflecting the design principles reinforced in the OWASP Non-Human Identity Top 10.
In practice, ZSP is most effective when paired with approval automation, secretless or short-lived authentication, and strong session logging so that access is not merely limited but also explainable after the fact.
Why It Matters in NHI Security
ZSP matters because persistent entitlements are one of the easiest paths from a single compromised credential to enterprise-wide impact. NHI Mgmt Group research shows that 97% of NHIs carry excessive privileges, which means standing access is not a niche problem but a systemic one in many environments. That risk becomes especially serious when secrets are embedded in code, reused across services, or exposed to third parties. The Ultimate Guide to NHIs — Key Challenges and Risks shows how excessive privilege and weak lifecycle controls amplify breach impact, while the OWASP Non-Human Identity Top 10 highlights the recurring failure modes around over-permissioning and secret misuse.
ZSP also strengthens Zero Trust Architecture because trust is granted per request, not by historical identity status. That makes it a governance control as much as a technical one: teams must define who can approve access, how long it lasts, what telemetry is retained, and how emergency break-glass access is handled without becoming permanent. Organisations typically encounter the urgency of ZSP only after a service account is abused in an incident, at which point revoking standing privilege becomes operationally unavoidable to address.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 address the attack and risk surface, while NIST Zero Trust (SP 800-207) and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST Zero Trust (SP 800-207) | Section 2.1 | Zero Trust requires continuous verification rather than persistent trust. |
| OWASP Non-Human Identity Top 10 | NHI-01 | Overprivileged NHIs and standing access are core NHI risk patterns. |
| NIST CSF 2.0 | PR.AC-4 | Least-privilege access management maps directly to privilege minimization. |
Review NHI permissions regularly and replace persistent privilege with just-in-time grants.
