TL;DR: Just-in-time access reduces standing privilege but does not solve the governance gap created when access is still requested, approved, and revoked through human-paced IAM workflows, according to Ploy. The model is useful, but it only works when entitlement scope, auditability, and revocation are tightly controlled, not assumed.
At a glance
What this is: This is an analysis of just-in-time access that concludes temporary permissioning can reduce standing privilege, but only if request, approval, and revocation workflows are tightly governed.
Why it matters: It matters because IAM and PAM teams often treat just-in-time access as a complete control, when the real risk moves to entitlement scope, revocation timing, and auditability.
Context
Just-in-time access is a temporary permission model, not a replacement for identity governance. It changes when access exists, but it does not remove the need to know who can request it, what they can reach, and how quickly it disappears after the task ends.
For NHI and human IAM programmes alike, the control only works when the governance layer is explicit. If approvals, task scope, and revocation are still handled as loosely managed workflows, the organisation has shifted the problem rather than solved it.
Key questions
Q: What breaks when just-in-time access is only an approval workflow?
A: It stops being a privilege control and becomes a faster way to issue temporary standing access. If approval, activation, and revocation are not tightly coupled, the organisation still carries the same governance risks, just inside a shorter window. The control has to enforce expiry, not merely record intent.
Q: When does just-in-time access reduce more risk than it adds?
A: Just-in-time access reduces more risk when the organisation can reliably automate approval, scope the privilege to a task, and revoke it immediately after use. It adds risk when teams keep broad base roles, weak review processes, or manual workflows that delay revocation. JIT is most effective as part of a broader zero-standing-privilege model.
Q: What are the signs that a just-in-time access process is failing in practice?
A: Common warning signs are long approval delays, reviewers making rushed decisions, and access requests being approved with little context. Another red flag is heavy reliance on static auto-approval rules that become brittle, hard to audit, and easy to misuse. If those patterns are present, JIT is likely behaving like a slow-standing-access system rather than a true control.
Q: When should teams use just-in-time access for privileged actions?
A: Teams should use just-in-time access whenever a task requires elevated permissions that should not remain standing all day. It is most effective for administrative actions, sensitive application changes, and recovery operations, because it reduces the time window in which a compromised identity can cause damage.
Technical breakdown
How just-in-time access changes entitlement duration
Just-in-time access grants permissions for a narrow task window instead of leaving them permanently enabled. In practice, that means the security question moves from "who has access" to "who can obtain access, under what conditions, and for how long." The model depends on an access broker, policy logic, and a reliable way to expire rights once the work is done. If any of those pieces are weak, temporary access can become de facto standing access with extra ceremony.
Practical implication: validate that task-scoped access actually expires when the task ends.
Why auditability becomes the control boundary
The article points to a common governance truth: temporary access is only defensible when every request, approval, and revocation step is visible. Auditability is not just logging after the fact, because the value lies in proving that access scope matched the task and that revocation happened promptly. Without that evidence, JIT becomes difficult to distinguish from ad hoc privilege assignment. For identity programmes, this shifts oversight from entitlement catalogues to transaction-level access records.
Practical implication: require a complete audit trail for each temporary entitlement from request to revocation.
Where JIT access intersects with PAM and IAM
JIT access sits between IAM policy and PAM execution. IAM defines eligibility and policy, while PAM or a similar control enforces temporary elevation and session boundaries. That separation matters because many organisations have approval workflows but lack true privilege containment once access is granted. The strongest implementations connect identity context, approval logic, and revocation timing so the elevated state is observable and bounded. When that integration is missing, JIT becomes an access request process rather than a governance control.
Practical implication: integrate JIT decisioning with PAM enforcement so elevation and revocation stay coupled.
Breaches seen in the wild
- Poland ArcGIS password leak 2023: An ArcGIS login emailed in 2020 was published from stolen mail in 2023 and still worked, exposing Polish military and infrastructure maps.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Just-in-time access is a duration-control, not a privilege model. It reduces exposure by shortening the time a permission exists, but it does not change the underlying governance requirement to define scope, ownership, and revocation. That means teams should stop treating JIT as a substitute for entitlement discipline. The practitioner conclusion is that access lifetime becomes the key control variable.
The real failure mode is governance drift between request and revocation. Once approvals are human-paced or loosely automated, the temporary grant can outlive the task it was meant to support. That creates a gap between policy intent and effective enforcement. The practitioner conclusion is that access workflows need the same scrutiny as the permissions they issue.
Temporary access still depends on standing trust in the requester and the workflow. JIT assumes the request context is accurate and that the revocation event will actually fire when the work ends. If either assumption fails, the programme has not removed risk, it has relocated it into control latency. The practitioner conclusion is that entitlement scope and expiry handling must be governed as first-class security controls.
Identity governance is moving from static assignment to conditional issuance. That shift affects human users, service accounts, and emerging agentic workflows alike because the core question becomes whether access can be issued and withdrawn with trustworthy state transitions. JIT strengthens the case for least privilege, but only if the organisation can prove the privilege was truly ephemeral. The practitioner conclusion is to manage issuance integrity, not just entitlement inventory.
From our research library:
- 91% of organisations say at least half of their privileged access is always-on, and only 1% have fully implemented just-in-time privileged access, according to a CyberArk study.
- Read next: Just-in-Time Access and Zero Standing Privilege Guide
What this signals
Ephemeral credential trust debt: organisations that adopt JIT still inherit trust assumptions from the request and revocation workflow, which means the control surface shifts rather than disappears. The programme should now measure whether temporary access can be issued, contained, and removed without manual lag.
Access governance will increasingly be judged by whether access can be proven to end cleanly, not by whether it was approved quickly. That makes revocation evidence and task scoping more important than the label attached to the control.
AI-assisted access workflows raise the stakes because 43% of security professionals are concerned about AI systems learning and reproducing sensitive information patterns from codebases, according to the State of Secrets in AppSec.
For practitioners
- Define task-scoped entitlement boundaries Map each JIT workflow to a specific task, resource set, and maximum duration so temporary access cannot silently expand beyond the request intent.
- Enforce revocation as a control event Treat privilege expiry as an enforced event rather than a best-effort cleanup step, with monitoring that confirms the entitlement actually disappears.
- Review approval latency against exposure windows Measure how long temporary access remains active after approval and before revocation, then tighten any workflow that leaves excessive access time on the clock.
- Separate eligibility from execution Use policy to decide who may request elevation, but require a distinct enforcement layer to grant, session-bind, and revoke the access itself.
- Test audit trails end to end Verify that every temporary grant produces a complete record of request, approval, activation, and revocation that can be reconciled during review.
Key takeaways
- Just-in-time access reduces standing privilege, but the control only works when request, scope, and revocation are tightly governed.
- The main governance risk shifts to workflow latency, unclear task boundaries, and weak evidence that temporary access actually ended.
- PAM and IAM still matter because JIT changes when access is granted, not whether the organisation needs strong containment and auditability.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 addresses the attack and risk surface, while NIST SP 800-53 Rev 5, CIS Controls v8 and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-05 — Overprivileged NHI | JIT is presented as a response to excessive standing privilege and access scope. |
| NHI-07 — Long-Lived Secrets | The article argues for shortening access lifetime instead of leaving permissions persistently active. | |
| Recommendation — Use NHI-05 to reduce standing privilege and scope temporary access to the exact task. Use NHI-07 to eliminate long-lived credentials and replace them with expiring access. | ||
| NIST SP 800-53 Rev 5 | IA-5 — Authenticator Management | Temporary access depends on credential issuance, expiration, and revocation discipline. |
| Recommendation — Apply IA-5 to manage authenticators so time-bound access expires and is revoked on schedule. | ||
| CIS Controls v8 | CIS-5 — Account Management | The article centres on managing access duration, approvals, and removal of access. |
| Recommendation — Use CIS-5 to govern account lifecycle, approval, and removal for temporary access. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | The piece is about controlling who can hold which entitlements and for how long. |
| Recommendation — Apply PR.AA-05 to govern entitlements, approval paths, and revocation timing. | ||
Key terms
- Just-in-time tool access: Just-in-time tool access means granting a testing agent only the permissions it needs for a specific task and only for the time required. In offensive AI workflows, this limits the blast radius if the system behaves unexpectedly or reaches beyond its intended scope.
- Standing Privilege: Standing privilege is access that remains active even when no immediate task requires it. For NHI programmes, it is a common failure mode because long-lived credentials and persistent roles create unnecessary exposure. Reducing standing privilege usually means tighter expiry, on-demand access, and clearer review of who or what still needs access.
- Immediate revocation: Immediate revocation means a credential stops working as soon as the system marks it invalid. For machine identities, this matters because any delay creates a residual exposure window, which can be enough for continued abuse after access should have ended.
- Entitlement Scope: Entitlement Scope is the exact set of actions, resources, or permissions attached to an identity during a session. In cloud and NHI governance, scope is as important as duration because broad permissions can turn a short-lived grant into a high-impact access event. Narrow scope is a core control objective.
Deepen your knowledge
NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.
Published by the NHIMG editorial team on September 2, 2026.
Updated on October 11, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org