Instacart’s JIT access model shows where identity governance is heading

At a glance

What this is: NHI Mgmt Group's analysis, drawing on C1.ai's blog post: Instacart's move to fully automated just-in-time access shows that micro-reviews and policy-driven expiry can replace standing access and traditional quarterly user access reviews.

Why it matters: It matters because IAM, PAM, and NHI programmes are converging on the same governance pattern: access should be issued, reviewed, and revoked in short-lived policy windows rather than left standing.

👉 Read C1.ai's account of Instacart's just-in-time access model

Context

Just-in-time access is a governance model in which entitlements exist only for the task at hand, then expire unless they are explicitly renewed. In this post, C1.ai describes how Instacart moved from manual provisioning and quarterly review cycles to policy-driven micro-reviews that are easier to audit and harder to leave standing.

The identity lesson is broader than one company’s workflow redesign. When access windows become ephemeral, IAM, PAM, and NHI governance start to share the same operating assumption: entitlement should be issued close to use, observed in code, and removed when the task is complete.

This matters especially for environments that mix human users, service access, and emerging AI-agent requests. The article shows how a short-lived access model can tighten control without forcing teams back into manual ticket handling.

Key questions

Q: What breaks when standing access is replaced with JIT access?

A: The main failure point is the old assumption that access should remain available long enough to be reviewed later. In a JIT model, entitlement can expire before anyone notices drift, so governance has to move to request time, policy time, and renewal time rather than relying on quarterly certification.

Q: Why does JIT access reduce risk in sensitive business apps?

A: Because it narrows the time window in which a credential or entitlement can be misused. Short-lived access also forces users to prove continued need, which reduces unused permissions and limits the blast radius if an account or workflow is compromised.

Q: What are the signs that AI-assisted access governance is working?

A: Signs include fewer toxic access combinations, cleaner role definitions, faster remediation of conflicting access, and stronger audit evidence from continuous monitoring. If AI is only producing reports while access keeps drifting, the programme is generating insight without control. Effective governance changes permissions, not just visibility.

Q: How should security teams govern just-in-time access for non-human identities?

A: Security teams should treat JIT as a timing control, not a trust control. Require contextual checks on the issuer, workload, and requested resource before granting access, and define deny rules for identities that behave outside baseline patterns. That approach limits abuse while preserving production continuity.

Technical breakdown

Why standing access weakens entitlement governance

Standing access creates a permanent authorisation state that no longer matches how work actually happens. Once a user or team has persistent entitlement, access reviews become retrospective paperwork rather than a control over present risk. In the Instacart model, expiry becomes the default state and renewal is the exception, which shifts governance from periodic certification to issuance-time policy enforcement. That design is especially relevant where audit evidence matters, because each access event carries its own approval and trace. The technical change is not just workflow automation. It is a move from durable entitlements to time-bounded access objects that can be governed as code.

Practical implication: Treat expiry as the default condition for sensitive access and review whether standing entitlement is still justified anywhere in scope.

How policy-as-code changes micro-reviews

Policy-as-code turns access decisions into versioned, testable rules instead of manual approvals hidden in tickets. The article describes policies built from HR attributes, team structure, geography, job title, and external checks such as training completion. That lets each request become a micro-review, meaning the control is evaluated at the moment access is needed rather than during a quarterly recertification cycle. For auditors, the value is the traceability of change history and consistent enforcement. For practitioners, the important shift is that governance logic moves into code review, which makes access policy easier to reproduce, test, and explain.

Practical implication: Move recurring approval logic into code and use source-controlled policy changes as the evidence trail for access decisions.

Why JIT access is becoming relevant beyond human IAM

The article’s most forward-looking point is that the same short-lived access model is now being considered for non-human identities and AI agents. That matters because machine and agent access often needs to be granted quickly, but still with strong governance over scope and duration. The underlying control question changes from who approved the user to what condition justified the entitlement and when it should disappear. This is where JIT starts to bridge human IAM and NHI governance: both depend on short-lived authorization, auditable renewal, and a reliable offboarding path after use. The model becomes more important as access is requested by systems that operate in seconds, not quarters.

Practical implication: Extend short-lived access policy design to service accounts, workload identities, and AI agents before those identities inherit standing privilege patterns.

NHI Mgmt Group analysis

Micro-review governance is replacing access review as the meaningful control boundary. Quarterly user access reviews assume entitlement lasts long enough to be meaningfully certified after the fact. In a JIT model, each request is the control point, so the governance object is the access event rather than the standing account state. That changes how teams think about evidence, ownership, and remediation across IAM and PAM.

Standing access is not just a privilege problem, it is a lifecycle problem. The article shows that unused permissions disappear naturally when access must be renewed, which means offboarding pressure is shifted into the access window itself. This is a stronger governance pattern than trying to clean up accumulated access later. Teams should read that as a lifecycle redesign, not a workflow optimisation.

Short-lived access is now the common language for human IAM and NHI governance. Instacart’s next step toward non-human identities and AI agents signals that the same policy model will govern more than employees. Access windows, audit trails, and renewal logic are becoming the shared control fabric across identity types, which makes old distinctions between human and machine entitlement less useful.

Policy-as-code is becoming the trust model auditors will actually accept at scale. When access rules are versioned, peer-reviewed, and traceable in Git, the audit conversation shifts from asking whether access existed to whether the control logic was governed well. That is a material change for programmes trying to scale without adding review fatigue. Practitioners should expect evidence quality, not ticket volume, to become the measure of maturity.

Ephemeral entitlement is the right named concept for this shift. Access governance is moving from durable grants to expiring, condition-based permissions that only exist while work is active. That creates a cleaner boundary for IAM, PAM, and NHI programmes alike, because the control is anchored to use rather than ownership. The practical conclusion is that identity teams need to govern access duration as tightly as access scope.

From our research library:

• 91% of organisations say at least half of their privileged access is always-on, and only 1% have fully implemented just-in-time privileged access, according to a CyberArk study.

What this signals

Ephemeral entitlement will become the default design pattern for mature identity programmes. Teams that still rely on quarterly cleanup will find that their control model lags how work is actually executed. The practical shift is to govern access duration as tightly as access scope, especially where sensitive apps and automation already depend on fast approvals.

Access governance is converging across human, machine, and agentic identities. Once organisations accept that access should expire unless actively renewed, the same control model can be reused for service accounts, workload identities, and AI agents. That convergence is where NHI governance becomes operational rather than theoretical.

For practitioners

• Define expiry as the default for sensitive access Review privileged and sensitive entitlements so that standing access exists only where a documented exception is justified. Make renewal the normal path and require explicit re-approval for continued use.
• Translate recurring approvals into code Move repeat access decisions into source-controlled policy so reviewers can inspect rules, test changes, and trace entitlement history. Use version history as the evidence trail for audit readiness.
• Use task-based micro-reviews instead of quarterly recertification alone Treat each access request as a governed event with its own context, approval logic, and expiry, especially for sensitive business applications and engineering workflows.
• Extend JIT design to non-human identities Apply the same short-lived access model to service accounts, workload identities, and AI agents so machine access does not inherit permanent privilege patterns.
• Build an exception path for high-pressure workflows Identify business processes such as support, finance, and close activities where access must be fast, then predefine policy-driven approvals so teams do not revert to standing access.

Key takeaways

• Standing access is increasingly the wrong default because it creates entitlement that outlives the work it was meant to support.
• The article shows that micro-reviews and policy-driven expiry can replace quarterly access reviews without losing auditability.
• Identity teams should govern access duration, renewal, and traceability with the same discipline they apply to access scope.

Key terms

• Just-in-Time Access Request: Just-in-Time Access Request is a pattern that grants access only when it is needed and only for the duration required. It reduces standing privilege by making access temporary, policy driven, and task scoped. This approach is especially useful for contractors, sensitive systems, and short-lived operational work.
• Micro-review: A micro-review is a small, event-based access control checkpoint attached to a single request or renewal. It replaces large periodic recertifications with narrower, better-scoped evidence points, which makes governance easier to audit and often more accurate for short-lived access.
• Policy as Code: Policy as code stores authorization logic in version control and evaluates it through testable, reviewable rules. For agent governance, it makes runtime decisions reproducible and measurable, which is critical when actions can be triggered by untrusted content and executed at machine speed.
• Standing Access: Standing access is persistent privilege that remains available without fresh approval or contextual checks. In NHI environments, standing access usually appears as long-lived tokens, reusable service accounts, or broad roles attached to automation. It is convenient operationally, but it expands risk when conditions change or secrets leak.

What's in the full article

C1.ai's full blog post covers the operational detail this post intentionally leaves for the source:

• Terraform-backed policy workflows and how Instacart used GitHub review history as audit evidence
• The dual-path rollout approach for moving users from legacy requests to JIT access
• How Gadjit scores JIT requests using peer adjacency, role similarity, and risk profile
• The specific ways Instacart expanded JIT to sensitive business apps like Stripe

👉 The full C1.ai post covers the policy design, audit trail, and rollout advice behind the Instacart program

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.