TL;DR: P0 Security says privileged access management is shifting from vault-based credential storage to runtime authorization because cloud environments rely on short-lived workloads, service accounts, APIs and automation, making standing privilege and long-lived control planes harder to apply cleanly. The control point is moving from secret custody to policy enforcement at execution time, where identity, context and scope must line up on demand.
At a glance
What this is: This whitepaper argues that PAM is moving away from vault-centric credential storage toward runtime authorization for cloud, workload and automation-heavy environments.
Why it matters: This matters because IAM teams now have to govern privileged access where the actor is often a workload, API or automated process rather than a human administrator.
👉 Read P0 Security's whitepaper on runtime privileged access in cloud environments
Context
Privileged access management no longer maps cleanly to environments built around static administrator credentials. In cloud-native systems, the privileged actor is often a service account, workload, API or automation path that needs access only for a short window and may never touch a vault in the traditional sense.
That shift changes the governance problem from storing credentials securely to deciding whether access should exist at runtime at all. For NHI and PAM teams, the core question becomes how to enforce least privilege when the identity, context and execution path are all transient.
Key questions
Q: What breaks when privileged access is controlled only by a vault?
A: A vault controls where the credential sits, but not what happens after the credential is released. Once the password is checked out or exposed, attackers can use memory theft, malware, insider misuse, or session abuse to extend impact. Privileged access therefore needs inline enforcement, not only protected storage.
Q: Why does runtime authorization reduce risk for service accounts and workloads?
A: Runtime authorization reduces risk because it ties access to the current action, context and identity state instead of assuming a pre-issued credential should remain valid. For service accounts and workloads, that means privilege can be scoped to the workflow and removed when the action completes, which narrows exposure and limits reuse.
Q: What are the signs that vault-centric PAM is not keeping up with cloud operations?
A: Common signs include persistent privileged entitlements, manual exceptions for automation, broad service account permissions and frequent reliance on shared credentials to make workflows function. If teams cannot map privilege to a specific runtime decision, the PAM model is probably operating as a secret repository rather than a governance control.
Q: Should teams prioritise just-in-time access or vault expansion for cloud privilege?
A: Teams should prioritise just-in-time access when the privileged action is short-lived and context-dependent, because vault expansion increases custody overhead without fixing the underlying entitlement problem. Vaults still matter for some secrets, but they do not solve the governance gap created by standing privilege in runtime workflows.
Technical breakdown
Why vault-centric PAM struggles with cloud-era identities
Vault-centric PAM assumes privileged access is mediated through stored secrets that can be checked out, rotated and audited over time. That model works best when the identity is stable and the access path is human-driven. Cloud environments break that assumption because workloads, APIs and service accounts are instantiated and retired continuously, while access decisions often happen inside orchestration layers or application calls. The result is a mismatch between long-lived credential custody and short-lived execution needs. Practical implication: do not treat vaulting as the control objective when the privileged actor is ephemeral.
Practical implication: classify which privileged identities never need a human checkout flow and route them to runtime controls instead.
Identity-native authorization shifts control to execution time
Identity-native authorization evaluates privilege where the action occurs, rather than relying on a separate credential repository as the main gate. That means access is enforced through policy, identity context, workload attributes and request scope at runtime. In practice, this reduces the dependence on standing secrets and long-lived shared credentials, especially in cloud systems where API calls and automation are the normal path to privileged action. It also aligns better with ephemeral infrastructure because entitlement can be granted for the task and revoked when the session or workflow ends. Practical implication: design for authorization points that can evaluate every privileged action as it happens.
Practical implication: move privileged decision points into the control path that executes the workload, API or automation step.
Just-in-time access becomes the default governance pattern
Just-in-time access is not just a convenience feature in cloud environments; it is a governance response to identities that change faster than traditional review cycles. When a privileged action is needed only briefly, persistent entitlements create avoidable exposure and complicate revocation. Runtime privilege models therefore favour short-lived access, policy checks and task-scoped permissions over standing grants. This is especially relevant for service accounts and automation paths that may otherwise accumulate broad access simply because they are difficult to manage manually. Practical implication: reduce permanent privilege wherever the task can be authorized at execution time.
Practical implication: remove standing grants from workflows that can be safely authorized only when the task begins.
Breaches seen in the wild
- Azure Key Vault Contributor escalation 2024: Datadog found Azure Key Vault Contributor could add itself to access policies and read every secret, key and certificate in a vault.
- BeyondTrust breach 2024: A stolen BeyondTrust Remote Support API key let a China state-sponsored actor reset accounts and reach US Treasury workstations in 2024.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 150+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Vault-centric PAM is no longer the primary control plane for cloud privilege: it was designed for stored credentials, human checkout flows and relatively stable administrator identities. That assumption fails when privileged action is embedded in cloud automation, service accounts and short-lived workloads. The implication is that privileged access governance now starts at execution time, not in a vault lifecycle.
Runtime privileged access is a governance shift, not just an architectural preference: the change is from protecting secrets to controlling whether privilege exists at the moment of use. That matters because many cloud identities never need persistent access at all, only policy-validated access tied to a task or context. Practitioners should interpret this as a change in governance model, not a cosmetic control update.
Standing privilege has become the clearest marker of excess in modern cloud IAM: persistent grants broaden the attack surface, complicate offboarding and make review cycles less meaningful for transient identities. A runtime model does not remove the need for governance, but it moves governance to entitlement issuance and action-level authorization. The practical conclusion is that the weakest point is no longer the vault, but the privilege that outlives the task.
Next-generation PAM is converging with workload identity and policy enforcement: the market is moving toward identity-native authorization because cloud systems increasingly treat every privileged action as a software-mediated event. That brings privileged access closer to the identity fabric of the environment and away from a separate secret store. Teams should expect PAM programmes to be judged on runtime control quality, not credential inventory size.
Ephemeral access windows change what it means to audit privilege: if access exists only for the duration of a workflow, review processes built around persistent entitlements lose analytical value. The more cloud operations rely on automation and APIs, the more privilege governance must focus on issuance, context and revocation at execution time. Practitioners should treat this as a redesign of privilege governance, not a tuning exercise.
From our research library:
- 97% of NHIs carry excessive privileges, increasing unauthorised access and broadening the attack surface, according to the Ultimate Guide to NHIs.
- 73% of vaults are misconfigured, leading to unauthorised access and exposure of sensitive data, according to the Ultimate Guide to NHIs.
- Read next: NHI Lifecycle Management Guide
What this signals
Runtime privileged access changes the measurement target: the control question is no longer how many secrets sit in a vault, but whether privilege is issued only when the workload or automation step actually needs it. That shift will force PAM and IGA programmes to align more closely with workload identity and lifecycle governance.
Standing privilege becomes the audit smell that matters most: cloud programmes that still rely on persistent grants will continue to accumulate excess access across service accounts, APIs and automation paths. Teams should expect governance conversations to move from credential storage to runtime entitlement issuance.
Identity-native authorization is the more durable pattern for cloud privilege: it gives practitioners a way to govern access where execution happens, which is the only place transient privilege can be controlled consistently. The practical next step is to assess which privileged flows can be removed from vault checkout entirely.
For practitioners
- Map privileged workflows to runtime control points Inventory where privileged actions occur through workloads, APIs, service accounts and automation, then identify the exact decision point where access is granted or denied.
- Reduce standing privilege in cloud operations Remove persistent grants from identities that only need access during a task, and replace them with task-scoped, short-lived authorization.
- Separate secret custody from authorization Treat vaults as one layer of control, but do not assume secret storage equals privilege governance in cloud-native execution paths.
- Review service accounts and API-led privilege paths Focus on identities that act without direct human checkout, since these are the most likely to carry excess scope into production workflows.
Key takeaways
- Cloud privilege now spans short-lived workloads, service accounts and APIs, so traditional vault-centric PAM is no longer sufficient on its own.
- The central governance shift is from protecting stored secrets to enforcing authorization at runtime, where identity and context are known.
- Teams should focus on standing privilege, task-scoped access and execution-time policy decisions to narrow cloud exposure.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 addresses the attack and risk surface, while NIST SP 800-53 Rev 5, NIST CSF 2.0 and NIST Zero Trust (SP 800-207) set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-05 — Overprivileged NHI | The article centres on standing privilege and excess access in cloud identities. |
| NHI-07 — Long-Lived Secrets | Vault-centric PAM depends on long-lived credential custody, which the article argues is losing fit. | |
| Recommendation — Reduce persistent access and scope privileged NHI entitlements to the task that actually needs them. Replace reusable secrets with short-lived access patterns wherever runtime authorization is available. | ||
| NIST SP 800-53 Rev 5 | IA-5 — Authenticator Management | Authenticator lifecycle and rotation remain relevant where privileged access still uses managed credentials. |
| Recommendation — Apply authenticator lifecycle controls to eliminate stale privileged credentials and reduce reuse risk. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | The article is about governing entitlement decisions for privileged cloud access. |
| Recommendation — Govern privileged entitlements at the point of authorisation and remove standing access wherever possible. | ||
| NIST Zero Trust (SP 800-207) | Policy as the decision point — Policy as the decision point | Runtime authorization aligns with Zero Trust by moving access decisions into policy. |
| Recommendation — Enforce access at runtime through policy decisions tied to identity, context and task scope. | ||
Key terms
- Runtime Privileged Access Control: The practice of governing what an actor can do during an active privileged session, not just whether the session was approved. It shifts enforcement from credential issuance to session behavior, which is critical when attackers can abuse valid access after login.
- Standing Privilege: Standing privilege is access that remains active even when no immediate task requires it. For NHI programmes, it is a common failure mode because long-lived credentials and persistent roles create unnecessary exposure. Reducing standing privilege usually means tighter expiry, on-demand access, and clearer review of who or what still needs access.
- Identity-Native Authorization: Identity-native authorization is a control model that decides access at the point of action rather than only at account provision time. It matters for service accounts, workloads, and API-driven processes because the identity itself, not a vault workflow, becomes the boundary for privileged behaviour.
- Just-in-Time Access Request: Just-in-Time Access Request is a pattern that grants access only when it is needed and only for the duration required. It reduces standing privilege by making access temporary, policy driven, and task scoped. This approach is especially useful for contractors, sensitive systems, and short-lived operational work.
What's in the full article
P0 Security's full whitepaper covers the operational detail this post intentionally leaves for the source:
- Architectural examples of runtime privileged access across cloud infrastructure and automation
- The paper's explanation of how just-in-time access fits into modern PAM redesign
- Its discussion of how to modernise without disrupting existing operations
- The article's framing of where identity-native authorization replaces vault-centric control
Deepen your knowledge
NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.
Published by the NHIMG editorial team on September 30, 2026.
Updated on October 8, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org