Just-in-time workload access exposes the limits of standing privilege

At a glance

What this is: This is an analysis of just-in-time workload access and why standing credentials create persistent attack paths for non-human identities.

Why it matters: It matters because IAM teams need controls that govern workload access at issuance time, not only after secrets have already been distributed and exposed.

By the numbers:

• GitGuardian’s 2026 report found 64% of secrets confirmed valid in 2022 were still active and exploitable four years later.

Context

Just-in-time workload access is a governance model for non-human identities that replaces always-on credentials with short-lived access issued only when a workload needs it. The problem it addresses is not just secret sprawl, but the fact that standing privileges outlive the task they were created for and remain usable long after context has changed.

That matters for IAM, PAM, and NHI governance because traditional access review and rotation cycles assume a credential exists long enough to be reviewed or rotated. In modern cloud and CI/CD environments, that assumption breaks down when access is expected to be ephemeral, policy-driven, and tied to runtime attestation.

Key questions

Q: What breaks when workload access still depends on standing keys?

A: Standing keys turn workload identity into a reusable backdoor because they stay valid long after the task that justified them has ended. That means compromise, reuse, and lateral movement all become easier. The failure is not just exposed secrets, but a governance model that assumes machine access can safely persist between jobs.

Q: Why do static workload credentials create more risk than they appear to?

A: Static workload credentials create durable trust, which means one stolen secret can be reused repeatedly until it is revoked or rotated. If that principal is over-privileged, the compromise can spread across systems through lateral movement. The risk is persistence, not just initial theft.

Q: How should teams decide when just-in-time access is better than long-lived secrets?

A: Teams should prioritise just-in-time access when a workload reaches sensitive data, production systems, or third-party services and does not need persistent reuse. If the access can be issued on demand and expires automatically, JIT usually lowers blast radius more effectively than standing credentials. The decision should be based on task duration and exposure cost, not convenience.

Q: How do security teams know if workload access management is actually working?

A: Workload access management is working when each request is evaluated in context and denied unless the workload, environment, and action all match policy. Warning signs include broad allow rules, static credentials, and access paths that remain valid after the workload’s task should have ended.

Technical breakdown

How workload attestation replaces static credential trust

JIT access for workloads starts with attestation, which is cryptographic proof that a workload is running in a trusted environment. Examples include cloud instance identity documents and Kubernetes service account tokens. The key shift is that the system does not trust the workload because it has a stored secret. It trusts the workload only after verifying identity and posture in real time. That moves the security decision from secret possession to runtime proof, which is the architectural basis for eliminating standing access in machine-to-machine flows.

Practical implication: govern workload access around attestation evidence, not around long-lived credentials.

Why standing secrets become persistent attack paths

Standing credentials are attractive to attackers because they are reusable, portable, and often copied across code, images, logs, and runtime environments. Once a key is exposed, it can remain valid across multiple systems until manually revoked or rotated, which creates a wide exploitation window. The article also notes that AI agents and LLMs expand exposure further because they can be coerced into revealing the keys they hold. This is an NHI governance problem, not just a leakage problem, because the credential lifecycle itself is too slow for the threat model.

Practical implication: prioritise controls that remove secret reuse and shorten validity windows for every workload credential.

How ephemeral token issuance changes access control

JIT access replaces preprovisioned secrets with ephemeral tokens that are created only when a workload request satisfies policy. A policy engine evaluates identity, environment, posture, and sometimes time of day before issuing access, then the token expires automatically when the task is complete. That is different from traditional IAM because validity is not assumed from the last successful login or token creation. It is revalidated at the point of use, which reduces the window for lateral movement and misuse while preserving automated machine-to-machine workflows.

Practical implication: move authorization decisions to the moment of use and make token expiry part of the control design.

Threat narrative

Attacker objective: The attacker’s objective is to turn one exposed workload credential into durable access across services and environments.

1. Entry occurs when a workload secret is exposed in code, images, or another store and an attacker obtains a valid key or token.
2. Credential access follows because the exposed credential can be reused without immediate expiry, giving the attacker persistent authenticated access.
3. Escalation and movement occur when that standing access is used across multiple systems before revocation catches up.
4. Impact is the continued use of the compromised workload path as an indefinite backdoor into connected services.

Breaches seen in the wild

• Hugging Face Spaces breach 2024: Unauthorised access to Hugging Face Spaces may have exposed secrets users stored for AI apps; tokens were revoked and org tokens removed.
• OneLogin API flaw (CVE-2025-59363): A OneLogin API flaw exposed OIDC client secrets to anyone with an API key, including vendors (CVE-2025-59363); fixed with no customer impact.

Read our 52 NHI Breaches Analysis report for a comprehensive view of breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Standing workload privilege is the structural failure, not just a poor secret-hygiene choice. Workload credentials that remain valid after issuance create a governance model built on persistence, while modern machine identity needs access that exists only at the moment of use. This is why JIT matters to NHI programmes: the control boundary has shifted from storage to issuance, and the practitioner implication is that standing privilege must be treated as the exception, not the baseline.

Credential review cadences were designed for access that lasts long enough to review. That assumption fails when workloads request and release access in minutes or seconds, because by the time a recertification cycle runs, the relevant privilege may already be gone. The implication is not merely to add more reviews, but to recognise that access governance for machine identities has to move earlier in the lifecycle, before a reusable secret exists.

Ephemeral credential trust debt: every secret that is issued but not time-bounded adds future exposure that the organisation must later pay down through revocation, rotation, and investigation. The article shows that secret lifetime, not just secret strength, determines blast radius. For practitioners, this means reducing the number of credentials that ever become reusable is more valuable than managing a larger estate of durable ones.

JIT access for workloads validates Zero Standing Privilege as an operating model for NHI. The point is not that every workload should be denied by default forever, but that no workload should hold a permanent credential simply because automation is convenient. That aligns with OWASP-NHI and Zero Trust Architecture thinking, where identity must be continuously re-evaluated rather than permanently trusted.

AI agents make the standing-privilege problem more visible, not less relevant. The article’s mention of AI agents and LLMs shows that any entity capable of holding and disclosing credentials increases the value of short-lived access. The practitioner implication is that NHI governance must cover both traditional workloads and emerging agentic systems under the same lifecycle discipline.

From our research library:

• 80% of identity breaches involved compromised non-human identities such as service accounts and API keys, according to the Ultimate Guide to NHIs.
• Read next: Just-in-Time Access and Zero Standing Privilege Guide

What this signals

Ephemeral credential trust debt: every workload secret that survives beyond the task that created it becomes future attack surface. JIT access reduces that debt by making issuance and expiry part of the control, not an afterthought.

Access review programmes that were tuned for human users do not solve workload access drift by themselves. The governance question for NHI teams is whether a credential ever becomes reusable in the first place, because once it does, revocation is already behind the threat.

A JIT model also changes how practitioners think about ZSP: the point is not just eliminating standing access on paper, but ensuring the runtime access path cannot be reused once the task ends.

For practitioners

• Map high-risk workloads first Begin with database connections, external API integrations, and CI/CD pipelines that already have production reach. These are the access paths where standing secrets create the largest blast radius and where JIT can reduce exposure fastest.
• Prove workload identity cryptographically Use environment attestation such as cloud instance identity documents or Kubernetes service account tokens before issuing temporary access. Treat that proof as the control point that replaces static trust in the credential itself.
• Issue short-lived tokens at request time Replace locally stored keys with tokens that are scoped to a single task and expire automatically when the job completes. Keep any brokered access hidden from the application so the workload never handles a reusable secret directly.
• Run JIT in shadow mode before enforcement Compare JIT policy decisions with your existing access model before turning on enforcement. Use that period to validate environment-based conditions, reduce false denials, and confirm that automation does not break production flows.
• Measure secret elimination and policy compliance Track how many static credentials are removed, how consistently decisions match policy, and how much manual rotation work disappears. Those measures show whether the programme is actually reducing standing privilege rather than just relocating it.

Key takeaways

• Standing workload credentials create a durable attack path because they remain valid far longer than the activity they were meant to support.
• The evidence base in the article points to a large residue of active secrets that outlive their original context, which keeps compromise windows open.
• The control shift is toward short-lived, policy-checked issuance, because reducing secret lifetime is more effective than managing a larger pool of reusable credentials.

Key terms

• Just-in-Time Access Request: Just-in-Time Access Request is a pattern that grants access only when it is needed and only for the duration required. It reduces standing privilege by making access temporary, policy driven, and task scoped. This approach is especially useful for contractors, sensitive systems, and short-lived operational work.
• Standing Privilege: Standing privilege is access that remains active even when no immediate task requires it. For NHI programmes, it is a common failure mode because long-lived credentials and persistent roles create unnecessary exposure. Reducing standing privilege usually means tighter expiry, on-demand access, and clearer review of who or what still needs access.
• Workload Attestation: Workload attestation is the process of proving that a workload is running in an expected, trusted environment before granting access. It helps stop copied credentials from being treated as universally valid and is a core control for reducing impersonation risk.
• Ephemeral Token: An ephemeral token is a short-lived credential issued at runtime for a specific service and scope. It reduces exposure because the token expires quickly and is not stored as a reusable secret in configuration, which makes theft, reuse, and offboarding materially easier to control.

Deepen your knowledge

NHI governance, workload identity security, and secrets management are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.