TL;DR: Most enterprise password managers still solve storage better than access governance, but Securden argues the real gap is deciding, in the moment, who should get a specific credential, for what reason, and for how long. Standing access accumulates into privilege creep, and access that is not time-bound becomes hard to justify, review, or revoke.
At a glance
What this is: This is an analysis of how just-in-time approval workflows move password managers from credential storage into credential governance, with privilege creep as the central risk.
Why it matters: It matters because IAM and PAM teams need controls that limit credential exposure windows, not just encrypt passwords and log retrievals.
Context
Enterprise password managers are often judged on whether they store credentials safely, but the harder problem is access governance. In practice, the question is not only whether a password is encrypted and rotated, but who can obtain it, under what justification, and for how long.
That gap matters because standing access tends to expand quietly across projects, contractors, and shared admin accounts. Once access becomes persistent, the password vault can be technically secure while still leaving far too many people able to retrieve sensitive credentials without current need or review.
Key questions
Q: What breaks when password managers only secure storage but do not govern access?
A: They leave standing credentials available long after the original need has ended, so password storage remains strong while access governance stays weak. That creates privilege creep, makes approvals hard to prove, and leaves auditors asking who authorised access and when it should have expired.
Q: Why do standing credentials increase IAM risk even when they are encrypted?
A: Encryption protects the secret in storage, but it does not limit who can obtain it or how long they can keep using it. Standing access expands the effective blast radius, creates privilege creep, and makes accountability harder because the original business need is no longer visible at the point of use.
Q: How do teams know if just-in-time access is actually reducing privilege risk?
A: They should verify that temporary access has strict expiry, clear approval traceability, and dependable revocation after task completion. If users can extend access easily or reuse temporary entitlements across multiple tasks, the programme is preserving standing privilege under a different label.
Q: When should organisations use approval workflows instead of direct credential release?
A: Use approval workflows whenever the credential is shared, privileged, or likely to outlive a single task. The point is to force a current justification, bind access to a defined duration, and ensure the password is no longer open once the work is complete.
Technical breakdown
Why password storage and access governance are different controls
Password storage protects the secret itself. Access governance protects the decision to disclose that secret. A vault can encrypt credentials, restrict the UI, and rotate on schedule, yet still fail to control whether a user should receive access at a specific moment. Just-in-time approval workflows add a decision layer before release, binding the credential to an approved purpose and a defined duration. That changes the control objective from protection at rest to controlled disclosure in use. Practical implication: treat request, approval, and expiry as distinct governance events, not as optional workflow metadata.
Practical implication: separate secure storage from governed disclosure and design controls for both.
How standing access turns into privilege creep
Privilege creep is the accumulation of access that no longer matches current need. It often begins with legitimate one-off grants for migrations, support, or emergency work and then survives because revocation is manual, delayed, or nobody owns the cleanup. Over time, the vault contains credentials that are technically protected but functionally overexposed. Once access is persistent, it becomes harder to justify, review, and defend. Practical implication: build expiry into the access path itself so access ends automatically when the approved use case ends.
Practical implication: make expiry automatic so access does not depend on memory or follow-up.
Why approval windows matter for shared credential accountability
Approval windows turn access into a bounded event rather than an open-ended permission. In a shared-credential model, this is especially important because it creates a time and session boundary around who can use a password and when. The article also notes that simultaneous use can be blocked, which improves accountability by reducing ambiguity about who was behind an action. Audit logging then records the request, approval, extension, session, and closure, which supports review and investigation. Practical implication: align approval duration, session control, and logging so every credential grant is attributable end to end.
Practical implication: use bounded sessions and complete logging to preserve accountability for shared accounts.
Threat narrative
Attacker objective: The objective is to obtain and use a still-accessible credential to reach a protected system without current authorization.
- Entry occurs when a credential remains accessible long after the approved business need has ended, creating a standing exposure point inside the vault.
- Escalation follows when an attacker or unauthorized insider obtains that credential through phishing, compromise, or simple discovery in an overextended access path.
- Impact occurs when the credential is used without any approval gate standing between the actor and the system it unlocks, enabling unauthorized system access and audit ambiguity.
Breaches seen in the wild
- Azure Key Vault Contributor escalation 2024: Datadog found Azure Key Vault Contributor could add itself to access policies and read every secret, key and certificate in a vault.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Password governance fails when access and storage are treated as the same control: A vault can protect the credential while still leaving the disclosure decision unconstrained. That distinction matters because security teams are accountable for who received the password, why, and for how long, not only whether it was encrypted. The practical conclusion is that governance has to start at request time, not after the secret has already been exposed.
Privilege creep is the default operating state of standing access: Access expands easily through one-time work, contractor support, and emergency grants, then rarely contracts on its own. That is not a user behaviour problem so much as a lifecycle design failure, because no control forces the revocation decision when the original purpose ends. The practitioner takeaway is that expiry must be structural, not discretionary.
Just-in-time approval workflows make auditability a design property, not a reconstruction exercise: When a request, approval, window change, session, and expiry are all logged as part of the same workflow, compliance teams no longer have to infer intent after the fact. That matters because auditors increasingly ask who approved access and when it was last reviewed. The field should treat logged approval as a governance primitive, not a reporting feature.
Short-lived credential release is becoming the boundary between PAM and password management: The market is moving toward password platforms that do more than store and rotate secrets. Once approval, duration, and revocation are built into the access path, the product is no longer just a vault. The implication for practitioners is that tool selection now has to account for whether access governance is native or bolted on.
Identity blast radius is the right way to think about shared credentials: Every unnecessary holder of a password expands the number of actors who can act with that identity. That makes access window length, simultaneous use rules, and revocation speed central to security design. The practitioner conclusion is that governance should be measured by how much credential blast radius is actually reduced, not by how many secrets are stored.
From our research library:
- 91% of organisations say at least half of their privileged access is always-on, and only 1% have fully implemented just-in-time privileged access, according to a CyberArk study.
- Read next: Just-in-Time Access and Zero Standing Privilege Guide
What this signals
Identity blast radius: The useful metric is no longer only how many credentials are stored, but how many people can still reach them after the work has ended. Once approval windows are tied to the request itself, the governance question becomes whether access truly collapses when the task does.
Access governance for passwords is converging with PAM expectations even when the platform is still called a password manager. Teams should watch for controls that bind release, session duration, and revocation together, because those are the mechanisms that turn a vault into a governed access path.
For practitioners
- Define access request criteria for shared credentials Require users to state purpose and expected duration before a password is released, and route the request through approval rather than direct retrieval.
- Set automatic expiry on every approved credential grant Bind each approval to a fixed access window and revoke or randomize the password when the window closes so no grant remains open by default.
- Separate approval paths by credential risk Use different approval depth for low-risk shared logins and high-risk privileged accounts so governance reflects account sensitivity instead of using one blanket process.
- Prevent concurrent use of shared credentials Block simultaneous access to the same credential and log request, approval, extension, session, and expiry so accountability remains traceable.
- Review dormant approvals and overdue access windows Search for credentials that stayed accessible after the work ended and remove any access that cannot be justified against an active business need.
Key takeaways
- Password managers that only encrypt and rotate credentials still leave a governance gap if access can persist without a current business reason.
- Standing access accumulates quietly across projects and shared accounts, which is why privilege creep remains a practical security problem.
- Approval workflows, time-bound release, and automatic revocation are the controls that turn password storage into defensible access governance.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 addresses the attack and risk surface, while NIST SP 800-53 Rev 5, NIST CSF 2.0 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-05 — Overprivileged NHI | Persistent shared credentials create excess access beyond current need. |
| NHI-07 — Long-Lived Secrets | The article centres on access that lingers after the work ends, not on storage alone. | |
| Recommendation — Reduce overprivileged access by binding credential release to a current approved need. Limit access windows so secrets do not remain usable after their approved purpose ends. | ||
| NIST SP 800-53 Rev 5 | IA-5 — Authenticator Management | IA-5 covers credential lifecycle controls including issuance, use, and revocation. |
| Recommendation — Apply authenticator management controls to ensure approved credentials expire and are revoked on schedule. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | The article is about governing who can obtain access, for what reason, and for how long. |
| Recommendation — Review access permissions so credential release is approved, time-bound, and traceable. | ||
| CIS Controls v8 | CIS-5 — Account Management | Standing access and delayed revocation are account management failures. |
| Recommendation — Tighten account management to remove dormant access and enforce timely revocation. | ||
Key terms
- Just-in-Time Access Request: Just-in-Time Access Request is a pattern that grants access only when it is needed and only for the duration required. It reduces standing privilege by making access temporary, policy driven, and task scoped. This approach is especially useful for contractors, sensitive systems, and short-lived operational work.
- Privilege Creep: Privilege creep is the gradual accumulation of access rights beyond what an identity actually needs. It usually happens when permissions are added for convenience and never removed. For NHIs, privilege creep expands blast radius and makes old credentials far more dangerous than their original purpose suggests.
- Access Governance: Access governance is the policy and workflow layer that manages how access is requested, approved, certified, and revoked. In SaaS environments it helps standardise control across many applications, reducing inconsistency between teams. It is most effective when it covers both human accounts and non-human identities.
- Approval Workflow: An approval workflow is the governed sequence that determines whether a request becomes active access. It usually combines routing, policy checks, and evidence capture. For identity teams, the important question is not how fast it runs, but whether each decision remains attributable and reviewable.
Deepen your knowledge
NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.
Published by the NHIMG editorial team on July 8, 2026.
Updated on October 11, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org