Jit access fails when break-glass becomes the real control

At a glance

What this is: This is an analysis of why JIT access programmes fail in practice when break-glass and shared admin paths become the real operating model.

Why it matters: It matters because IAM teams need to measure the access path people actually use, not the one the workflow approves, or privilege creep and emergency bypasses will undermine governance.

Context

Just-in-time access is meant to grant privileged access only when needed and remove it when the task ends. In practice, the control can be undermined by emergency accounts, shared credentials, and legacy standing access that never enters the workflow.

For IAM, PAM, and NHI governance teams, the problem is not only approval speed. It is whether the programme governs the full lifecycle of privileged access across the request, use, and revocation path, including the bypasses people create when the formal process is too slow.

The article also introduces agentic AI as a future extension point, but the core governance failure is already present in human-operated privilege paths. The same question applies whether the actor is a person or a non-human identity: what access actually gets used when the situation is urgent?

Key questions

Q: What breaks when a JIT access programme relies on break-glass and shared admin credentials?

A: The programme stops governing the access that matters. JIT can still produce clean request logs while real privileged work happens through emergency accounts, shared credentials, or persistent side paths. When that happens, the workflow becomes evidence of approval activity, not evidence of effective control over privileged execution.

Q: Why do emergency access paths create risk even when they help during incidents?

A: They create risk when they remain available after the incident or when they become the default route for routine work. Emergency access is acceptable as a narrow exception, but if revocation is not engineered and reviewed, the exception becomes standing privilege with a temporary label.

Q: How do you know if JIT access is actually working?

A: Look for short-lived sessions, complete approval records, and reliable revocation evidence. If developers still retain access after the task is complete, or if sessions cannot be tied back to a reason and owner, the model is not functioning as intended. Working JIT should leave a clear and complete audit trail.

Q: Should organisations manage JIT, PAM, and break-glass as one access governance problem?

A: Yes. They are different control patterns, but they govern the same privileged lifecycle. If teams separate them operationally, they often miss the gap between approved access and actual access use, which is where bypasses and entitlement sprawl accumulate.

Technical breakdown

Why JIT dashboards miss the real access path

JIT systems usually measure requests that move through the workflow, not the privileged actions that bypass it. When engineers use break-glass accounts, shared admin credentials, or a colleague’s persistent access, the request trail can look healthy while the operating model is not. That creates a false signal: control activity is visible, but control effectiveness is not. The technical weakness is coverage, not latency. The governance model observes the approval event, while the real access event happens elsewhere in the environment. In identity terms, the workflow is the record, not the control boundary.

Practical implication: Measure privileged actions outside the JIT path, not just request completion rates.

What approval theatre looks like in privileged access

Approval theatre happens when a control produces a logged decision without a meaningful decision process. A manager who approves every request in seconds, without context, is not making a risk decision. That approval may satisfy audit evidence, but it does not test entitlement appropriateness, incident context, or blast radius. The technical issue is that the workflow collects a name, not judgment. In complex environments, static approval rules cannot interpret operational context such as on-call status, active incidents, or the difference between read and write access. The control becomes ceremonial when the signal-to-decision gap is too large.

Practical implication: Review whether approvers can actually evaluate context before trusting the approval record.

Why return paths matter more than grant paths

Temporary access without engineered expiry behaves like standing privilege with a better origin story. Most programmes invest heavily in the grant path, but the revocation path is often a calendar reminder, a quarterly review, or a hope that someone will remember. That gap is where entitlement sprawl begins. The control problem is that revocation is treated as an administrative afterthought instead of a designed state transition. If a privilege can be granted for an incident and remain available after the incident closes, the lifecycle is incomplete. Effective governance requires the access to end as reliably as it starts.

Practical implication: Treat revocation as a first-class workflow event with an explicit end condition.

Threat narrative

Attacker objective: The objective is not an external attacker’s compromise, but operational privilege that escapes lifecycle control and remains usable outside the intended JIT process.

1. Entry occurs through a legitimate but unmanaged privileged path, such as a break-glass account or shared admin credential, rather than through the JIT workflow.
2. Credential access is effectively standing privilege, because the emergency path or side channel already exists before the incident begins.
3. Impact is reduced incident latency for the operator, but governance failure persists because the bypassed access path remains available after the event.

Breaches seen in the wild

• SonicWall SSL VPN account compromises 2025: Attackers used valid credentials to log in to more than 100 SonicWall SSL VPN accounts across 16 environments in October 2025.
• Azure Key Vault Contributor escalation 2024: Datadog found Azure Key Vault Contributor could add itself to access policies and read every secret, key and certificate in a vault.

Read our 52 NHI Breaches Analysis report for a comprehensive view of breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Approval workflow visibility is not privileged access governance: A JIT programme can record every request and still fail to govern the access that matters. The control boundary is the privilege actually used, not the ticket that was approved. That distinction is what separates a functioning lifecycle process from a reporting layer. Practitioners should treat hidden bypass paths as part of the identity estate, not exceptions outside it.

Missing return paths create standing privilege with temporary branding: When access is granted for an incident but revocation is left to memory, a reminder, or a quarterly review, the privilege effectively persists. The grant path gets engineered, but the end state does not. That is why entitlement sprawl accumulates in mature-looking programmes. The practical conclusion is simple: if access does not have a designed end condition, it was never truly temporary.

Break-glass is a control pattern, not a control substitute: Emergency access is legitimate in high-pressure operations, but it becomes a governance failure when it is the default path for real work. The environment then depends on bypasses to compensate for slow or brittle approval logic. That reveals a structural problem in PAM and access review design, not a user behavior issue. Teams should govern the bypass as carefully as the primary path.

Agentic AI changes the speed of decisioning, not the need for scoped privilege: The article’s agentic AI discussion matters because any system that grants production access becomes a privileged principal. The governance question is no longer only who requests access, but who or what can evaluate context and decide when access should exist. That pushes identity governance toward context-aware authorization and accountable policy design across human and non-human actors.

Identity governance must join operational context to access decisions: Static role checks cannot resolve incident context, on-call duty, or blast-radius constraints. That is why teams end up with both restrictive rules and informal bypasses. The field needs access governance that understands operational reality rather than pretending every request is a generic entitlement decision. Practitioners should align IAM, PAM, and incident response around the same decision boundary.

From our research library:

• 91% of organisations say at least half of their privileged access is always-on, and only 1% have fully implemented just-in-time privileged access, according to a CyberArk study.
• Read next: Just-in-Time Access and Zero Standing Privilege Guide

What this signals

Approval quality is the first signal to watch: If approvals are consistently fast, universally positive, and detached from incident context, the control is not making decisions. That pattern tells you the organisation has instrumented logging, not judgment, and the access path is likely drifting toward informal bypasses.

Break-glass usage should be a governance metric, not an exception log: Track how often emergency access is invoked, who authorised it, and whether the access was revoked on the declared end condition. The control weakens the moment emergency access becomes routine, because the bypass starts defining the operating model.

Temporary access that outlives the event is standing privilege in disguise: When expiry depends on memory or quarterly review, revocation becomes too slow to matter. The programme should treat end-of-access as part of the original decision, because access that cannot end predictably cannot be said to be temporary.

For practitioners

• Measure privileged actions outside the JIT path Inventory break-glass accounts, shared admin credentials, and standing production access, then compare their use against approved JIT requests each month.
• Design an explicit return condition Define the event that ends temporary access, such as incident closure or rollback completion, and automate revocation when that condition is met.
• Separate emergency access from routine operations Restrict break-glass access to genuine emergencies and require post-use justification so routine work does not migrate into the bypass path.
• Baseline approval quality before adding automation Sample approvals for context quality, rejection rate, and turnaround time to determine whether the current workflow is decisioning or mere logging.
• Treat the non-human access path as a governed principal Apply scoped credentials, non-repudiable logging, and review ownership to any system that can grant or use production access on behalf of people.

Key takeaways

• JIT access programmes often fail because the visible workflow is not the same as the privileged path people actually use.
• The article’s core warning is that approval theatre and missing revocation logic turn temporary access into persistent privilege.
• The fix is not more logging alone but governance over break-glass, shared credentials, and explicit end conditions for privileged access.

Key terms

• Just-in-Time Database Access: Just-in-time database access grants elevated access only for a short, task-scoped period and then removes it automatically. For database identities, the value is not only reduced exposure time but also a cleaner audit trail, because access exists only when there is a legitimate operational need.
• Break-glass Access: Break-glass access is an emergency path that bypasses normal access controls when standard authentication fails or a critical incident demands immediate intervention. It must be tightly time-bound, logged, and reviewed, because it exists to restore operations without becoming a permanent back door.
• Approval theatre: Approval theatre is a control pattern where access decisions are logged but not meaningfully evaluated. The process appears governed, yet the approver lacks time, context, or authority to assess risk, so the control satisfies records but not security outcomes.
• Standing Privilege: Standing privilege is access that remains active even when no immediate task requires it. For NHI programmes, it is a common failure mode because long-lived credentials and persistent roles create unnecessary exposure. Reducing standing privilege usually means tighter expiry, on-demand access, and clearer review of who or what still needs access.

Deepen your knowledge

Identity lifecycle management, secrets management, and workload identity security are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.