Jit access fails when break-glass becomes the real control

At a glance

What this is: This is an analysis of why just-in-time access programs often mask parallel privileged access paths, with the key finding that break-glass and standing access usually carry the work that matters.

Why it matters: It matters because IAM, PAM, and identity governance teams need to measure actual privileged action paths, not just approved requests, if they want JIT to reduce risk instead of documenting bypasses.

By the numbers:

• When AWS credentials are exposed publicly, attackers attempt access within an average of 17 minutes and as quickly as 9 minutes in some cases.

👉 Read Twine Security's analysis of why JIT access turns into break-glass

Context

Just-in-time access is supposed to narrow privileged exposure by granting elevated access only when a specific task requires it. In practice, many programmes become approval workflows with a compliance sheen while the real work still happens through break-glass credentials, shared admin accounts, or legacy standing access. JIT access governance is therefore as much about revocation and observability as it is about granting permissions.

The article's core point is that the failure usually appears during an incident, but the control weakness was created much earlier in ordinary operations. That makes this a PAM and identity lifecycle problem, not just an emergency response problem. The same pattern is common in environments where access reviews, temporary grants, and exception handling are treated as separate disciplines instead of one governed lifecycle.

For IAM teams, the useful question is not whether JIT exists on paper. It is whether the organisation can prove which identities actually performed privileged actions, whether those actions passed through governed paths, and whether temporary access truly ends when the task ends.

Key questions

Q: How should security teams stop just-in-time access from becoming break-glass by default?

A: Start by measuring real privileged action paths, not just approved requests. Then separate incident-driven emergency access from routine privileged work, enforce expiry on every temporary grant, and remove the shared or preserved credentials that people use when the JIT path is too slow. If the bypass is easier than the control, the control is not operating.

Q: Why do JIT programs still leave organisations exposed to standing privilege?

A: Because many programmes govern the request but not the removal. If revocation is manual, delayed, or only reviewed later, temporary access becomes standing access with a better narrative. The exposure remains even when the dashboard shows successful approvals, because the dashboard does not prove the privilege actually disappeared.

Q: What do security teams get wrong about approval workflows for privileged access?

A: They often confuse approval volume with control quality. A fast yes from a manager does not establish that the entitlement was necessary, narrow, or tied to a real operational event. Good governance requires contextual review of service ownership, incident state, and blast radius, not just a recorded click.

Q: Who is accountable when a non-human decision system helps grant privileged access?

A: A human remains accountable for the policy, the exceptions, and the outcomes. If a system helps decide who gets access, the organisation still needs a named owner who can explain the basis for the decision and prove that the decision logic is reproducible, reviewable, and limited by policy.

Technical breakdown

Why JIT access turns into a parallel access system

JIT access only works when the grant, use, and revocation events are all governed end to end. When approvals are slow, approvers are unavailable, or the target system sits outside the identity platform's coverage, teams create bypasses that become the operational norm. The result is a parallel access system: one path is visible to IAM, while the other path is where production changes actually happen. That is why dashboards can look healthy even when privilege is uncontrolled.

Practical implication: measure real privileged action paths, not just approved requests, and identify where bypasses have become the default workflow.

The missing return path in temporary privilege

Temporary access is not a control if revocation is informal. A JIT grant without an engineered expiry becomes standing privilege with a better story attached. In identity governance terms, the grant path and the removal path must be designed together, because the risk is not only over-provisioning but also privilege persistence after the task ends. This is where access review and PAM governance intersect with lifecycle management.

Practical implication: design revocation as a first-class workflow, with event-based expiry and verified deprovisioning rather than calendar reminders.

Why context-aware approval matters more than static rules

Static policy can tell you whether a role is allowed to request an entitlement, but it cannot interpret incident context, on-call status, active service ownership, or urgency. In a real incident, those signals determine whether access is appropriate and how much of it is needed. That is why rule engines often force a bad choice between over-granting and bypassing the process entirely. Context-aware governance is not about making policy looser; it is about making authorisation decisions defensible and narrowly scoped.

Practical implication: tie access decisions to live operational signals such as incident state, on-call rotation, and service ownership.

NHI Mgmt Group analysis

JIT access often fails because the organisation has built a grant process without a governable removal process. That is not a tooling problem alone. It is a lifecycle assumption failure: temporary access was treated as temporary by intent, not by enforcement. The implication is that access governance must be evaluated as a complete grant-to-revocation chain, not as an approval queue.

Approval theatre is a governance anti-pattern, not a control. When every request is approved in seconds from a phone, the workflow documents intent but does not test judgement. That breaks the assumption that human approval is itself a risk decision. Practitioners should treat approval quality, not approval volume, as the governance signal that matters.

The real control boundary is not the emergency itself, but the undocumented bypass that exists before the emergency arrives. Break-glass accounts, shared credentials, and preserved standing access are symptoms of a JIT model that has not reached the full estate. That is why JIT programme maturity must be judged by bypass reduction, not by request throughput.

Standing privilege persistence is the named failure mode this article exposes. Temporary grants become permanent when revocation is optional, delayed, or manual. That failure mode is especially dangerous in fast-moving operations because it hides inside routine exceptions. The practitioner conclusion is clear: if expiry is not enforced, the access was never truly just in time.

Agentic AI only changes the picture when it can read operational context and act on it at runtime. This article points to a broader governance shift: if an identity can evaluate incident state, on-call status, and service impact, then the old assumption that authorisation is a static, human-paced workflow no longer holds. That means identity governance has to move from form approval to decision provenance, with human accountability preserved at the policy level.

From our research:

• When AWS credentials are exposed publicly, attackers attempt access within an average of 17 minutes and as quickly as 9 minutes in some cases, according to LLMjacking: How Attackers Hijack AI Using Compromised NHIs.
• From our research: The average estimated time to remediate a leaked secret is 27 days, despite 75% of organisations expressing strong confidence in their secrets management capabilities, according to The State of Secrets in AppSec.
• From our research: See the Ultimate Guide to NHIs , 2025 Outlook and Predictions for how temporary access, lifecycle governance, and machine identity risk are converging.

What this signals

Standing privilege persistence: JIT programmes fail when revocation is treated as an administrative follow-up rather than an enforced control. For teams responsible for the Ultimate Guide to NHIs , 2025 Outlook and Predictions, the practical signal is whether temporary access actually disappears when the task ends.

The governance test is changing from request throughput to control coverage. If your environment still relies on break-glass accounts and shared admin paths, the programme is measuring compliance artefacts, not operational privilege. That gap will continue to surface in audit reviews, especially where secrets management and access governance are managed separately.

Teams should expect the next phase of identity governance to blend lifecycle enforcement, access decision provenance, and non-human accountability. The most mature programmes will prove who made the decision, what context informed it, and when the access was withdrawn.

For practitioners

• Measure privileged actions outside the JIT path Count every privileged operation performed through break-glass accounts, shared admin logins, preserved standing access, and informal human delegation. Track the share of privileged actions outside the JIT path monthly and use it as the real programme health metric.
• Engineer revocation as a separate workflow Define explicit expiry conditions, automated deprovisioning triggers, and verification steps for every temporary grant. Do not rely on calendar reminders or quarterly reviews to remove access that was created for a specific incident or task.
• Rebuild approval logic around live operational context Use incident state, on-call rotation, service ownership, and blast radius as inputs to access decisions. Restrict write access to the smallest task-scoped entitlement that satisfies the incident, rather than defaulting to broad admin permissions.
• Inventory the bypasses that sit outside identity tooling Review the legacy systems, vendor portals, shared team vaults, and preserved admin accounts that your JIT platform does not see. Treat every one of those paths as a governance gap until it is either brought under control or removed.
• Set a human owner for policy and exceptions Keep a named accountable owner for the approval model, exception handling, and outcomes review. Do not delegate accountability to the workflow itself, even when a non-human decision system is used to speed access decisions.

Key takeaways

• JIT access fails when organisations govern the request but not the revocation, leaving temporary access to harden into standing privilege.
• The strongest evidence of control weakness is the existence of bypass paths such as break-glass accounts, shared admin credentials, and preserved standing access.
• Practitioners should measure real privileged actions, enforce task-scoped expiry, and anchor approval decisions in live operational context rather than static role rules.

Key terms

• JIT — Just-in-Time Access: A security approach that grants access permissions only for the duration needed to complete a specific task, then automatically revokes them. JIT access eliminates standing privileges for NHIs, dramatically reducing attack surface.
• Break-glass Access: Break-glass access is an emergency path that bypasses normal access controls when standard authentication fails or a critical incident demands immediate intervention. It must be tightly time-bound, logged, and reviewed, because it exists to restore operations without becoming a permanent back door.
• Standing Privilege: Standing privilege is access that remains active even when no immediate task requires it. For NHI programmes, it is a common failure mode because long-lived credentials and persistent roles create unnecessary exposure. Reducing standing privilege usually means tighter expiry, on-demand access, and clearer review of who or what still needs access.

What's in the full article

Twine Security's full blog covers the operational detail this post intentionally leaves for the source:

• The article's full incident narrative showing how the 02:47 access request moved through the bypass path rather than the JIT workflow.
• The practical breakdown of context signals that matter in access decisions, including on-call status, incident state, and service ownership.
• The author's view on AI-enabled access decisions and why agentic context evaluation changes the governance model.
• The metrics section describing how to measure JIT effectiveness by privileged action path, break-glass usage, and revocation timing.

👉 Twine Security's full blog covers the bypass patterns, context signals, and access metrics in more detail.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an identity security programme, it is worth exploring.