TL;DR: Just-in-time access has shifted from a privileged-user control to a broader governance pattern for people, cloud services, pipelines, and agents, with Delinea arguing that standing privilege now creates unnecessary risk across both audiences. The deeper issue is that access review, offboarding, and audit models built around persistent credentials no longer fit ephemeral access patterns or autonomous execution loops.
At a glance
What this is: This is a Delinea analysis of how just-in-time privileged access now applies to both human and non-human identities, with the central finding that standing privilege is the real risk across both groups.
Why it matters: IAM, PAM, and NHI teams need to treat JIT as a shared governance pattern because access controls built for persistent users break down when workloads, pipelines, and agents also hold privilege.
Context
Just-in-time privileged access is a way to grant elevated access only when a task requires it, then remove it when the task ends. The governance gap is that many programmes still treat this as a human-admin control, even though modern environments now depend on service accounts, CI/CD systems, and other non-human identities that also need privileged access.
The article argues that standing privilege is no longer acceptable for either audience because credentials are now widely reused across cloud, developer, and automation environments. That changes the identity governance problem from managing a few powerful users to controlling ephemeral access for a much wider NHI estate.
Key questions
Q: How should security teams audit privileged access across human and non-human identities?
A: They should start with a complete privileged identity inventory that includes administrators, service accounts, API keys, certificates, pipeline credentials, and vendor accounts. The audit should verify ownership, lifecycle state, scope, and revocation logic for each identity. If the inventory is incomplete, the audit will miss the highest-risk access paths and produce false confidence.
Q: Why do certificates create risk in cloud and automation environments?
A: Certificates create risk when they outlive the workloads, pipelines, or data paths they were meant to protect. In cloud and automation environments, that persistence is easy to overlook because issuance and renewal are often fragmented. The practical problem is unmanaged trust, where a certificate still authenticates something even after the original governance decision has expired.
Q: What breaks when just-in-time access is applied only to users and not permissions?
A: The permission surface stays standing even if the login path is gated. That means any compromised credential tied to the role can still invoke unused rights the identity does not actually need. Real JIT reduces exposure only when the privilege itself is absent until a task requires it.
Q: How do teams balance JIT controls with developer productivity?
A: By keeping the tools and protocols developers already use while changing the credential lifetime behind the scenes. If JIT replaces SSH, kubectl, or database clients with a separate portal, users route around it and the control loses both adoption and security value.
Technical breakdown
How ephemeral privilege changes the control model
Just-in-time access replaces persistent elevation with task-scoped privilege, usually bound to a request, policy evaluation, approval path, session window, and audit trail. The technical point is not only that credentials expire, but that they are issued in response to context and withdrawn after use. That changes the attack surface because compromise value drops when a credential cannot be reused outside the approved window. For identity teams, the control is no longer just who can log in. It is who can obtain elevation, under what conditions, and with what session evidence.
Practical implication: design privileged access around issuance and expiry, not around static group membership.
Why cloud services and pipelines need JIT too
Modern privilege is often held by workloads, CI/CD jobs, containers, scripts, and agents rather than by named people. Those identities frequently rely on long-lived secrets in environment variables, code, caches, logs, or vault sprawl, which turns automation into a standing-access problem. JIT for non-human identities narrows the lifetime of the credential and the scope of the action, but it also forces the platform to know when a workload is allowed to ask for privilege at all. That is the real governance change: machine access becomes conditional rather than permanently trusted.
Practical implication: inventory privileged non-human identities and move their access from static secrets to time-bound issuance paths.
Why developers reject heavy-handed JIT implementations
The article makes a practical point that matters to architecture decisions: if JIT forces users to abandon SSH, kubectl, database clients, or familiar workflows, they will route around it. That is why access control must sit underneath the tools engineers already use, rather than replacing them with a separate portal or brittle workflow. Vault sprawl creates the same adoption problem because every extra vault adds another login, integration, and failure point. The control succeeds only when it preserves the native operating model while changing the privilege duration behind the scenes.
Practical implication: embed JIT into existing admin and developer workflows instead of introducing parallel access paths.
Breaches seen in the wild
- Azure Key Vault Contributor escalation 2024: Datadog found Azure Key Vault Contributor could add itself to access policies and read every secret, key and certificate in a vault.
- Microsoft SAS token exposure 2023: An over-permissive Azure SAS token in a Microsoft AI GitHub repo exposed 38TB, including workstation backups and Teams messages, for 3 years.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Just-in-time access has become a governance model for two identity populations, not one. The article correctly shifts JIT from a human-admin control to a shared pattern for people, workloads, pipelines, and agents. That matters because privileged access now exists wherever execution happens, not only where a person logs in. The practitioner conclusion is that privilege governance must be designed around the actor type actually holding the access.
Standing privilege is the control failure, not just a bad habit. Persistent credentials across cloud and automation environments create the conditions for broad compromise, because the access remains usable long after the original task ends. This is the same structural problem whether the subject is an admin account or a workload identity. The practitioner conclusion is to treat persistence itself as the risk boundary.
Ephemeral credential trust debt is now a useful way to describe the problem. Every place an organisation keeps a long-lived secret for a human, service, or automated process accumulates trust debt that can be spent by attackers or misused by internal tools. The article shows that this debt shows up in audit friction, developer workarounds, and access sprawl. The practitioner conclusion is to reduce the amount of trust that has to be repaid later.
JIT changes IAM and PAM from entitlement management to eligibility management. Access review and offboarding models built around persistent assignments do not describe how ephemeral privilege actually works. The important shift is not only shorter sessions, but a move to deciding when an identity is eligible to ask for privilege in the first place. The practitioner conclusion is to align governance with issuance, not with static access lists.
From our research library:
- 42% of machine identities have privileged access and 61% of organisations lack identity security controls for cloud workloads, according to CyberArk's 2025 Identity Security Landscape.
- 71% of NHIs are not rotated within recommended time frames, increasing the risk of compromise over time, according to the Ultimate Guide to NHIs.
- Read next: Just-in-Time Access and Zero Standing Privilege Guide
What this signals
Ephemeral credential trust debt: every long-lived secret retained for a workload, pipeline, or admin session increases the amount of trust the programme must later account for. When access can be issued just for a task, auditability improves because the control lives at the moment of elevation rather than after the fact.
JIT is now an architecture question as much as a policy question because cloud, developer, and automation identities all need access without inheriting permanent privilege. Teams that keep existing workflows while shortening credential lifetime will get better adoption than teams that force users into a separate access path.
For practitioners
- Define JIT eligibility by actor type Separate human privileged users from service accounts, workloads, pipelines, and agents, then set distinct rules for who can request elevation, under what task context, and for how long.
- Eliminate standing privilege for automation Identify long-lived secrets attached to CI/CD, cloud consoles, databases, Kubernetes, and internal services, then replace persistent access paths with time-bound issuance and expiry.
- Keep native workflows intact Preserve SSH, kubectl, database clients, and existing developer tools so that short-lived access is delivered underneath familiar workflows rather than through a separate portal.
- Reduce vault sprawl before scaling JIT Map where separate vaults, secret stores, and access brokers create duplicate control points, because fragmented secret estates make it harder to prove who had access and when.
Key takeaways
- Just-in-time access is no longer only about human administrators, because workloads and automation now hold privilege that can be just as dangerous when left standing.
- The article's key governance warning is that persistent credentials, vault sprawl, and access reviews built for permanent access do not describe modern privilege patterns well enough.
- Practical teams should focus JIT on issuance, expiry, and workflow fit so that short-lived access is actually usable instead of being bypassed.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 addresses the attack and risk surface, while NIST SP 800-53 Rev 5, NIST CSF 2.0 and NIST Zero Trust (SP 800-207) set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-05 — Overprivileged NHI | Standing privilege across workloads and pipelines is the core problem this article addresses. |
| NHI-07 — Long-Lived Secrets | The article centres on the risk created by long-lived credentials in cloud and automation environments. | |
| NHI-01 — Improper Offboarding | JIT depends on privilege disappearing when the task ends, which mirrors offboarding failure when access lingers. | |
| Recommendation — Reduce persistent elevation paths for non-human identities and issue privilege only for the task at hand. Replace long-lived machine secrets with time-bound credentials and revoke stale access paths. Remove access automatically when the task, job, or session ends so privilege does not persist by default. | ||
| NIST SP 800-53 Rev 5 | IA-5 — Authenticator Management | IA-5 directly governs credential lifecycle, including issuance and revocation for short-lived access. |
| AC-6 — Least Privilege | JIT is an operational form of least privilege for both human and machine identities. | |
| Recommendation — Use IA-5 to enforce short-lived authenticators and revoke unused credentials promptly. Apply AC-6 so privileged access is granted only when a specific task requires it. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | The article is fundamentally about who is authorised to obtain privileged access and when. |
| Recommendation — Define and enforce privileged access permissions that expire after the approved task or session. | ||
| NIST Zero Trust (SP 800-207) | 7.2 — Least Privilege Access | JIT aligns with zero trust by limiting access to what is required at the moment of use. |
| Recommendation — Limit access dynamically so privilege exists only while the approved work is in progress. | ||
Key terms
- Just-in-Time Privileged Access Management: A control model that grants elevated access only for a defined task or session, then removes it automatically. In cloud environments, it reduces the time privileged credentials remain usable and makes misuse harder to sustain. The value depends on strong approval, logging, and revocation processes.
- Standing Privilege: Standing privilege is access that remains active even when no immediate task requires it. For NHI programmes, it is a common failure mode because long-lived credentials and persistent roles create unnecessary exposure. Reducing standing privilege usually means tighter expiry, on-demand access, and clearer review of who or what still needs access.
- Ephemeral Credentials: Ephemeral credentials are short-lived access artefacts issued for a limited task or session. They reduce the window for abuse, but they only improve security when paired with strong scope limits, telemetry, and automatic revocation at task completion.
- Vault Sprawl: Vault sprawl is the uncontrolled growth of secret stores, vault instances, and duplicate credential repositories across an organisation. It creates fragmented access control, unclear ownership, and inconsistent rotation practices, which makes it difficult to prove where a secret lives or whether the authoritative copy is still in use.
Deepen your knowledge
NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.
Published by the NHIMG editorial team on June 20, 2026.
Updated on October 11, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org