JITA versus JITP: what zero standing privilege really requires

At a glance

What this is: This is a comparison of just-in-time provisioning and just-in-time access, with the central finding that only session-based, context-aware access can support true Zero Standing Privilege.

Why it matters: IAM and PAM teams need this distinction because temporary provisioning can still leave exploitable privilege windows, while real-time evaluation changes how access, revocation, and least privilege are governed across human, NHI, and autonomous programmes.

Context

Zero Standing Privilege depends on whether access is created as a persistent state or only as a live session. The article argues that just-in-time provisioning still relies on pre-staged accounts, assigned roles, and delayed revocation, which means the privilege exists long enough to be abused.

For identity governance, the distinction matters because access control is not only about shortening duration. It is about removing inheritance, eliminating lingering permissions, and making revocation depend on current context rather than a later cleanup step.

Key questions

Q: What breaks when just-in-time provisioning is treated as Zero Standing Privilege?

A: The model still creates an entitlement that can be used during its validity window, so privilege exists before revocation. That means the organisation has reduced duration, not eliminated standing access. For IAM and PAM teams, the failure is conceptual and operational: the access is still present long enough to be abused, audited only after the fact, and counted as temporary when it is not truly session-only.

Q: Why does waiting for access approval increase incident risk in production environments?

A: Approval delays extend the time between detection and remediation, which can let outages, service degradation, or attacker activity continue unchecked. In production incidents, every extra minute can increase business impact and reduce recovery options. Fast, pre-authorised access reduces operational drag, but it must be limited to the incident context and revoked once the response is complete.

Q: What are the signs that an access model is still leaving standing privilege?

A: Look for pre-provisioned accounts, assigned roles, time-boxed entitlements, and manual cleanup after access ends. If the privilege exists independently of the live session, the model is still stateful rather than ephemeral. Another warning sign is when revocation depends on a scheduled expiry instead of current context, because that leaves an exploitable access window in place.

Q: How should teams design access controls so privilege disappears when the session ends?

A: Use real-time policy evaluation tied to identity, context, and business need, then grant only session-scoped access with immediate revocation on context change. The control objective is not just short duration but no persistent entitlement inheritance. That approach is the practical boundary between temporary provisioning and true zero standing privilege.

Technical breakdown

Why just-in-time provisioning still leaves a privilege window

Just-in-time provisioning, or JITP, creates access only when needed, but it still does so by creating accounts or entitlements that persist for a defined period. That means the identity model remains stateful: the privilege exists, can be inherited, and can be abused before the clock runs out. In practice, JITP reduces exposure time, but it does not eliminate standing access as a security state. The article’s key point is that a shorter lifetime is not the same as no standing privilege. This is a control-lifecycle problem, not a branding problem.

Practical implication: treat JITP as temporary access reduction, not as evidence of Zero Standing Privilege.

How just-in-time access removes privilege at the session layer

Just-in-time access, or JITA, evaluates the request in real time using identity, context, and business need, then grants access only for the active session. The access is session-scoped rather than account-scoped, so there is no persistent role assignment left behind after the work is done. That design changes the enforcement point from provisioning time to decision time. The article also describes continuous revocation when context changes, which makes access contingent on the session staying valid. This is the architecture that aligns with Zero Standing Privilege.

Practical implication: move policy evaluation to login and session continuity, not to delayed account provisioning.

Zero standing privilege depends on continuous evaluation, not cleanup

The deeper difference is that ZSP is not achieved by revoking access later. It is achieved by never letting the access exist as a durable entitlement in the first place. That is why continuous access evaluation and immediate revocation matter more than post hoc removal jobs. If the control model assumes that someone will clean up access after a fixed period, then privilege still exists in the meantime. True ZSP requires current signals to decide whether access should continue now, not whether it was acceptable earlier.

Practical implication: design access governance around real-time context and session termination, not delayed entitlement removal.

Breaches seen in the wild

• Azure Key Vault Contributor escalation 2024: Datadog found Azure Key Vault Contributor could add itself to access policies and read every secret, key and certificate in a vault.
• BeyondTrust breach 2024: A stolen BeyondTrust Remote Support API key let a China state-sponsored actor reset accounts and reach US Treasury workstations in 2024.

Read our 52 NHI Breaches Analysis report for a comprehensive view of breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

JITP is a time-limited standing-access model, not Zero Standing Privilege. The article is correct to separate temporary provisioning from session-scoped authorization. The governance mistake is treating a shorter-lived role as if it were a different security state. Practitioners should not confuse reduced exposure with eliminated exposure.

Zero Standing Privilege only becomes real when privilege is decided at access time, not granted ahead of it. The important shift is from account creation to contextual authorization. That is where identity, business need, and current posture intersect, and where lingering entitlements stop being the default. The implication for teams is that provisioning workflows are not the control plane for ZSP.

Access models that rely on delayed revocation still preserve a blast-radius window. If a privilege exists long enough to be approved, used, and then later removed, the attack surface still existed during the interval. That is why continuous evaluation matters more than after-the-fact cleanup. Practitioners should measure whether access can disappear in-session, not only after the session.

Ephemeral entitlement is a named gap worth tracking separately from standing access. This is the control condition where access is technically temporary but still pre-created, inherited, and exploitable during its validity window. The distinction is central to modern IAM, PAM, and NHI governance because it determines whether least privilege is enforced dynamically or only administratively. Teams should reframe access reviews around live decision points, not historical assignment records.

From our research library:

• 80% of identity breaches involved compromised non-human identities such as service accounts and API keys, according to the Ultimate Guide to NHIs.
• 59% of organisations say they lack viable alternatives to standing privileged access for NHIs and AI agents, according to Delinea research.
• Read next: Just-in-Time Access and Zero Standing Privilege Guide

What this signals

Ephemeral entitlement debt: Temporary access that still depends on assigned roles accumulates governance debt because the access state survives long enough to be misused. Teams should classify these workflows separately from true session-only access and track them as residual standing privilege.

The programme implication is straightforward: if your access control still needs cleanup jobs to finish the job, you have not eliminated privilege persistence. That distinction should influence how IAM, PAM, and NHI teams measure Zero Standing Privilege maturity.

Real-time revocation becomes the operational proof point, not the policy claim. Access that can continue after context changes, even briefly, is still standing access in practical terms.

For practitioners

• Differentiate JITP from JITA in policy language Write governance standards so temporary provisioning is not counted as Zero Standing Privilege unless access is granted only for the active session and removed when context changes.
• Shift approval logic to real-time context Require current identity, device, role, and business-need signals at access time so the entitlement is never pre-staged as a persistent role assignment.
• Remove post hoc cleanup as the primary control Treat delayed deprovisioning as a residual safety measure, not the mechanism that makes the access model secure.
• Test whether access can vanish mid-session Validate that context changes such as loss of posture, off-call status, or session disconnect revoke access before the task is complete.
• Review standing privilege windows in production workflows Map every temporary access path that still creates an assigned account, entitlement, or role and classify it as standing privilege until proven otherwise.

Key takeaways

• The article separates temporary provisioning from true session-scoped access, and that distinction determines whether Zero Standing Privilege is real or only claimed.
• Standing privilege can still exist inside a time-limited access window, which means temporary access is not the same as eliminated privilege.
• Real-time context checks and in-session revocation are the controls that move access from administrative convenience to enforceable zero standing privilege.

Key terms

• Just-in-Time Provisioning: Just-in-time provisioning creates an account or entitlement at the moment it is needed, then removes it later. It reduces standing access duration, but it still relies on a static identity or role existing during the access window, which leaves room for misuse if revocation lags.
• Just-in-Time Access Request: Just-in-Time Access Request is a pattern that grants access only when it is needed and only for the duration required. It reduces standing privilege by making access temporary, policy driven, and task scoped. This approach is especially useful for contractors, sensitive systems, and short-lived operational work.
• Zero Standing Privilege: A control model in which an identity does not keep persistent access unless it is actively needed. For NHIs, this means credentials and permissions are issued for a narrow task and then removed. It reduces the time window and reuse value of stolen access.
• Continuous Access Evaluation: Continuous access evaluation is the practice of rechecking whether a principal should still have access after the session begins. In NHI environments, it matters because tokens and service accounts can remain valid while the surrounding risk changes, so enforcement has to follow the request, not just the login.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.