PAM is shifting from accounts to actions in privileged access

At a glance

What this is: SSH Communications Security’s source article argues that privileged access is moving from account-centric control to action-centric governance as non-human identities and automation drive more privileged activity.

Why it matters: That matters because IAM, PAM, and NHI programmes now have to govern privileged behaviour at the moment of use, not just inventory accounts and rotate passwords after the fact.

Context

Privileged access control is the discipline of deciding which identities can perform high-risk actions such as changing infrastructure, altering security controls, or reaching protected data. In this article, the governance gap is that those actions are increasingly executed by non-human identities and automation rather than by a small set of administrator accounts, so the old account-centric PAM model no longer describes the real risk boundary.

The article frames this as a shift from vaulting credentials to governing privilege at the point of action. That matters for identity programmes because service accounts, AI agents, workloads, and APIs now create a much larger privileged activity surface than traditional human admins, and those identities often operate unattended with broad entitlements.

Key questions

Q: What breaks when PAM still centers on accounts instead of actions?

A: Account-centric PAM misses the decision point that now matters most. When service accounts, pipelines and AI agents are the ones acting, a vault can protect the secret but still fail to stop an unauthorised action. The control must move to the moment of execution, where the policy can permit or deny the action itself.

Q: Why do static NHI credentials create more risk than human credentials in cloud environments?

A: Static NHI credentials are reusable, often high privilege, and usually lack the human controls that limit user accounts, such as MFA and session review. They also tend to spread into code, logs, and pipelines, which makes compromise easier to scale across connected systems.

Q: What are the signs that a PAM programme is not keeping up with non-human privilege?

A: The clearest signals are broad permanent entitlements, repeated use of long-lived secrets, and access reviews that say little about actual runtime actions. If service accounts, workloads, or AI agents are carrying the most sensitive permissions, but the programme still reports mainly on admin accounts, the control model is lagging reality.

Q: When should organisations prioritise zero standing privilege over traditional vaulting?

A: They should prioritise zero standing privilege when privileged tasks are intermittent, repeatable, or short-lived, because persistent admin access adds exposure without adding value. If the role does not need continuous elevation, standing privilege becomes unnecessary attack surface and a governance burden.

Technical breakdown

Why account-centric PAM loses visibility when privilege becomes an action

Classic PAM was built around named administrator accounts, credential vaulting, and session oversight. That model assumes privilege is durable, attached to a person or system account, and observable through login events. When privilege is expressed as a sequence of actions across services, APIs, and workloads, the control point shifts from account ownership to action authorisation. The practical problem is that the risky event is no longer just who logged in, but what was allowed to happen after the identity was already inside the environment.

Practical implication: Treat privileged action as the control boundary, not the account name.

How just-in-time privilege changes non-human identity governance

Just-in-time access and zero standing privilege reduce exposure by issuing rights only when needed and letting them expire automatically. For non-human identities, that is more than a convenience pattern. It means the identity can be governed at issuance time, with policy, risk, and context applied immediately before the action executes. The article’s core point is that static grants and long-lived secrets cannot keep up with ephemeral, unattended activity from service accounts, automation pipelines, and AI agents.

Practical implication: Move non-human privilege decisions to issuance time and let standing access disappear.

Why vaulting alone cannot manage SSH keys, certificates, and ephemeral credentials

Vaulting is still useful for storage and rotation, but it does not by itself solve access timing, contextual entitlement, or action-level authorisation. If a secret exists for long enough to be reused broadly, the organisation still carries standing risk even when the credential is technically stored in a vault. The article also highlights a gradual migration path from SSH keys to certificate-based authentication, which reflects a broader shift toward ephemeral trust rather than preserved secrets.

Practical implication: Use vaults as one control layer, not as the definition of privileged governance.

NHI Mgmt Group analysis

Privilege is now an action property, not an account property. The article’s central shift is that organisations can no longer define PAM as protection for a small set of administrator logins. Privileged access now emerges from what an identity is permitted to do at runtime, across systems, security controls, and other identities. That changes the governance object itself, so practitioners must stop measuring only accounts and start measuring privileged actions.

Non-human identities now carry the majority of privileged risk surface. Service accounts, automation pipelines, APIs, workloads, and AI agents often outnumber human users and operate unattended. That is not just a volume problem, it is a governance problem because these identities are harder to review through human-oriented access models. The implication is that NHI programmes and PAM programmes are converging on the same control boundary: issuance, scope, and expiry of privilege.

Just-in-time access is becoming the default control logic for high-risk identity behaviour. The article shows why static credentials and password vaults are reaching their limits when access must follow policy and context in real time. Short-lived credentials, ephemeral certificates, and zero standing privilege are not separate trends, they are the operating model for privileged access in dynamic environments. Practitioners should expect entitlement control to move closer to the moment of action.

Account-centric review processes are no longer sufficient for unattended privilege. Traditional access review assumes there is a stable account state to certify, revoke, or recertify. That assumption holds poorly when privilege is granted on demand, used briefly, and then discarded by non-human actors. The result is not just a tooling gap, it is a governance gap between lifecycle review and runtime privilege.

Hybrid PAM, IGA, and secrets governance is becoming the practical architecture. The article’s most useful signal is that PAM is no longer a standalone domain. Real-world governance now spans identity sources, entitlement policy, secret handling, SSO, and device or context verification. The practitioners who will cope best are the ones who design a connected control plane for privileged actions rather than preserving silos around vaults or admin accounts.

From our research library:

• 19% of organisations give AI systems dramatically more access than human employees, nearly one in five granting unrestricted privilege, according to the 2026 Infrastructure Identity Survey.
• 67% of organisations still rely heavily on static credentials despite the risks they pose to agentic AI deployments, according to the 2026 Infrastructure Identity Survey.
• Read next: Guide to NHI Rotation Challenges

What this signals

Privilege is becoming a runtime governance problem: access review cycles and periodic certification assume there is a stable privilege state to inspect. When service accounts, workloads, and AI agents acquire privilege only for a task, the control has to shift toward issuance-time policy and expiry enforcement.

Action-based PAM changes how identity teams should measure exposure: the relevant unit is no longer the number of accounts in a vault, but how many identities can perform sensitive actions without standing privilege. That forces PAM, IGA, and secrets management to operate as one control fabric rather than separate projects.

For practitioners

• Reframe privileged scope around actions Inventory the high-risk actions that matter most in your environment, then map which identities can execute them today. Use that list to replace account-based PAM reporting with action-based entitlement governance.
• Reduce standing privilege for non-human identities Prioritise service accounts, automation pipelines, APIs, and workloads that still hold persistent access. Move them toward just-in-time issuance and short-lived credentials where the action window is narrow and auditable.
• Use vaults as storage, not as the control objective Keep vaulting for secret custody, but measure whether the real control problem is access timing, entitlement scope, or credential lifetime. A vaulted secret that still grants broad standing access remains a governance exposure.
• Align PAM and IGA policy sources Pull roles and permissions from authoritative identity sources at the point of access so policy changes, risk changes, and user state changes can affect privilege in real time. That reduces the gap between review cycles and actual privilege use.
• Plan a certificate-based path for SSH key replacement Where SSH key governance is still central, map a phased migration from key-based access to certificate-based authentication and keep full audit trails during the transition. That lets you reduce long-lived key exposure without forcing an unrealistic big-bang replacement.

Key takeaways

• The article’s main risk is that privilege is no longer well described by account inventories, because unattended identities now execute more sensitive actions than traditional admins.
• The evidence points to a governance gap in static credentials, vault-centric control, and review cadences that do not match runtime privilege.
• The practical response is to govern privileged actions at issuance time, shorten credential lifetime, and tie PAM more tightly to identity policy sources.

Key terms

• Action-based privilege: A model where privilege is defined by what an identity can do to systems, data, or controls, not by the label on the account. It is especially important for service accounts, workloads, and AI agents, where inherited permissions matter more than human-style login flows.
• Zero Standing Privilege: A control model in which an identity does not keep persistent access unless it is actively needed. For NHIs, this means credentials and permissions are issued for a narrow task and then removed. It reduces the time window and reuse value of stolen access.
• Just-in-Time Access Request: Just-in-Time Access Request is a pattern that grants access only when it is needed and only for the duration required. It reduces standing privilege by making access temporary, policy driven, and task scoped. This approach is especially useful for contractors, sensitive systems, and short-lived operational work.
• Ephemeral Credentials: Ephemeral credentials are short-lived access artefacts issued for a limited task or session. They reduce the window for abuse, but they only improve security when paired with strong scope limits, telemetry, and automatic revocation at task completion.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity security are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.