Just-in-time privilege models expose the real limits of standing access

At a glance

What this is: This is a Hydden analysis of how just-in-time access and zero standing privilege change privileged access governance, with the key finding that account behaviour and usage data determine who can safely move away from persistent elevation.

Why it matters: It matters because IAM, PAM, and NHI teams need a defensible way to reduce exposure without breaking operations, and that requires measuring real usage rather than treating privilege as a static assignment.

By the numbers:

• If you migrate 100 privileged accounts that were previously 24/7 elevated to 4-hour JIT sessions used twice weekly, you reduce privileged access exposure by 95%.

Context

Standing privilege creates a control problem because access is persistent even when real use is intermittent. In identity governance terms, the issue is not just who can reach privileged systems, but whether elevation exists longer than the work that justifies it.

Just-in-time access and zero standing privilege change the operating model for PAM, IGA, and workload governance. The central question is which accounts truly need continuous elevation and which only need time-bound access tied to observable behaviour.

For IAM teams, the practical challenge is continuous classification. Environments change, roles drift, and privilege accumulates, so candidates for ephemeral access have to be rediscovered and re-evaluated on an ongoing basis.

Key questions

Q: What breaks when standing privilege is not removed for privileged users and service accounts?

A: Standing privilege breaks the assumption that access is only available when needed. When a privileged credential stays valid after the task ends, compromise of that credential gives attackers a ready-made path to sensitive systems, lateral movement, and administrative actions without a fresh approval step.

Q: When should organisations prioritise PAM replacement over more tuning?

A: They should consider replacement when the tool cannot support the environments they already run, especially Kubernetes, cloud-native workflows, and delegated third-party access. If the platform requires repeated exceptions to stay usable, the organisation is already paying a hidden governance cost in shadow access and manual workarounds.

Q: How do teams know whether zero standing privilege is actually working?

A: Teams should look for evidence that privileged access is time-bound, fully revoked, and impossible to reuse outside the approved session. If old secrets remain valid, break-glass accounts stay active, or administrators can operate without a fresh grant, ZSP is only partially implemented.

Q: What is the difference between just-in-time access and standing privilege?

A: Just-in-time access grants privilege only for a defined task window, while standing privilege remains active until someone removes it. JIT reduces exposure by shrinking the time an identity can be abused, but standing privilege creates a constant attack surface. For NHI programs, the difference is often the difference between contained risk and persistent exposure.

Technical breakdown

How usage patterns identify candidates for ephemeral privilege

The technical signal for moving an account to JIT is not job title alone, but the gap between assigned access and actual use. Access frequency, session duration, IP diversity, failed authentication attempts, and entitlement-to-usage ratio all help distinguish persistent need from permission creep. Accounts that touch privileged systems rarely, or that only use a small fraction of their entitlements, are strong candidates for ephemeral elevation. This is especially useful when log data is spread across PAM vaults, directory services, identity tools, and target systems.

Practical implication: build migration queues from observed usage, not from static role assumptions.

Why visibility is the real implementation bottleneck

The biggest blocker is not whether a PAM platform can enforce ephemeral access, but whether the organisation can see all existing privileged accounts and their behaviour. Without continuous discovery, new admin accounts, contractor access, mergers, and permission accumulation quickly make any JIT rollout stale. Identity data has to be refreshed continuously or the programme becomes a snapshot that misses newly created standing access and growing privilege scope.

Practical implication: treat discovery and usage analysis as a standing control, not a one-off migration project.

Breaches seen in the wild

• Azure Key Vault Contributor escalation 2024: Datadog found Azure Key Vault Contributor could add itself to access policies and read every secret, key and certificate in a vault.
• BeyondTrust breach 2024: A stolen BeyondTrust Remote Support API key let a China state-sponsored actor reset accounts and reach US Treasury workstations in 2024.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Zero standing privilege is a governance model, not a feature toggle. The article correctly shows that ephemeral access only works when teams continuously decide which accounts are still legitimate candidates for persistent elevation. That shifts PAM from enforcement alone to lifecycle judgement, where identity behaviour becomes the evidence base for access duration. Practitioners should treat JIT as an ongoing control decision, not a deployment milestone.

Access review assumptions weaken when privilege exists only briefly. Traditional review processes assume privilege persists long enough to be observed, sampled, and certified. If access is granted only for short, task-scoped windows, the control point moves to issuance time and review becomes a poor primary safeguard. The implication is that governance has to move earlier in the lifecycle, before the session starts.

Ephemeral access exposes identity blast radius. The article’s 95% reduction example shows that exposure is primarily a function of how long privilege remains usable, not how many tools sit behind the PAM stack. That means account behaviour, not entitlement count, is the sharper measure of residual risk. Practitioners should use usage patterns to define blast radius instead of relying on standing role names.

Permission creep is the operational reason standing access survives. Developers, administrators, and service owners accumulate elevation over time because organisations tolerate persistent access as a convenience layer. JIT forces a re-evaluation of that convenience and makes dormant privilege visible as a governance debt. The practical conclusion is that persistent elevation should require explicit operational justification, not historical inertia.

Continuous discovery is now part of access governance. New privileged accounts, new business units, and changing infrastructure mean that ephemeral-access candidates cannot be identified once and forgotten. That makes identity telemetry a governance input, not just a monitoring by-product. Teams that do not continuously reassess privilege scope will keep mistaking outdated inventories for current control.

From our research library:

• 91% of organisations say at least half of their privileged access is always-on, and only 1% have fully implemented just-in-time privileged access, according to a CyberArk study.
• Read next: Just-in-Time Access and Zero Standing Privilege Guide

What this signals

Identity blast radius is the better measure than privilege count. Moving from standing access to JIT changes the risk equation because exposure is now measured by how long privilege exists, not just how much privilege exists. That is why access governance needs behavioural telemetry, not static entitlement reports, to stay credible.

Continuous discovery has become part of access governance. New admin accounts, contractor access, and permission drift can recreate standing privilege faster than teams can recertify it. Organisations that do not continuously classify privileged behaviour will keep mistaking a clean inventory for a controlled environment.

For practitioners

• Map privileged accounts by real usage Use access frequency, session duration, entitlement-to-usage ratio, and failed authentication patterns to rank accounts for JIT migration. Prioritise accounts that reach privileged resources less than once per day and accounts whose entitlements exceed their observed use.
• Define task-based session boundaries Set maximum session duration and approval rules by task type, then tighten scope so the granted privilege matches the stated work. Short administrative tasks, troubleshooting, and emergency access should not share the same duration or approval logic.
• Rebuild governance around discovery Continuously identify newly created admin accounts, contractor access, and permission accumulation so the ephemeral-access candidate list stays current. Treat new privilege grants as governance events that require the same behavioural analysis as existing accounts.
• Use approval requests as detection signals Flag unusual timing, unexpected justifications, and off-hours access requests before privilege is granted. In an ephemeral model, the request itself becomes part of the security signal, so workflows should surface anomalies instead of hiding them in routine operations.

Key takeaways

• Standing privilege remains a core identity risk because it outlives the actual work that needs elevation.
• Hydden's example shows that moving 100 accounts from 24/7 privilege to 4-hour JIT sessions can cut exposure by 95%.
• The control point shifts from granting access once to continuously proving which accounts still deserve persistent elevation.

Key terms

• Just-in-Time Access Request: Just-in-Time Access Request is a pattern that grants access only when it is needed and only for the duration required. It reduces standing privilege by making access temporary, policy driven, and task scoped. This approach is especially useful for contractors, sensitive systems, and short-lived operational work.
• Zero Standing Privilege: A control model in which an identity does not keep persistent access unless it is actively needed. For NHIs, this means credentials and permissions are issued for a narrow task and then removed. It reduces the time window and reuse value of stolen access.
• Entitlement-to-usage ratio: A measure of how much assigned access is actually exercised by an identity. Low usage relative to broad entitlements usually indicates over-provisioning, permission creep, or inherited access that has outlived its original purpose.
• Permission Creep: The gradual accumulation of access beyond what a user or workload currently needs. It usually happens because initial approvals are never fully removed or recertified. In practice, permission creep is a lifecycle failure that turns temporary exception access into de facto standing privilege.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.