Zero standing privileges and the new baseline for NHI access

At a glance

What this is: CyberArk frames zero standing privileges as a baseline for NHI access, with just-in-time entitlement granting replacing persistent access wherever possible.

Why it matters: For IAM and PAM teams, the issue is how to reduce always-on NHI privilege without assuming ZSP alone covers every account type, workflow, or exception.

Context

Zero standing privileges is a privilege model that removes persistent entitlements and grants access only when it is explicitly needed. In NHI programmes, that changes the control point from account ownership and static provisioning to entitlement issuance and policy decisioning.

The gap this article addresses is not whether privilege should be governed, but where standing privilege can be removed without breaking operational use cases. That matters because many identity programmes still treat vaulting, rotation, and access approval as sufficient even when entitlements remain always-on underneath.

The article also makes a narrower operational point: ZSP is useful, but not universal. Tenant-level creation flows, exception handling, and other edge cases still need a governance model that prevents exceptions from becoming permanent access by another name.

Key questions

Q: What breaks when least privilege is not enforced for NHIs?

A: When least privilege is not enforced for NHIs, credentials and service accounts retain more power than the task needs. That widens blast radius, increases the value of a stolen secret, and makes lateral movement easier after any compromise. The practical failure is not access itself but persistent access that no longer matches business need.

Q: When should teams prioritise ZSP over conventional PAM approaches?

A: Prioritise ZSP when an NHI's access can be made truly session-scoped and the business can tolerate issuance at use time. If the account must remain broadly authorised for operational reasons, conventional PAM controls may still be needed, but teams should avoid calling that zero standing privilege.

Q: How do security teams know JIT access is actually ephemeral?

A: JIT is ephemeral only if the entitlement disappears after the task or session ends and does not persist as a reusable standing permission. If the same access can be reactivated automatically without fresh policy decisioning, the process is delaying privilege rather than removing it. Measure the state of the entitlement, not just the approval step.

Q: What is the difference between ZSP and vaulting for NHI access?

A: Vaulting protects the secret that unlocks access, while ZSP removes the standing entitlement that makes the secret useful at all times. Vaulting can coexist with persistent privilege, but ZSP changes the authorisation model itself. Teams need both where appropriate, but they should not confuse secret custody with privilege elimination.

Technical breakdown

How zero standing privileges changes the access model

Zero standing privileges, or ZSP, removes persistent entitlements from an identity estate and grants them only at the moment of need. In practice, that means the identity has no usable privilege when idle, and access is issued through policy or automation rather than left attached to the account. For NHIs, this shifts security from static entitlement governance to time-bound issuance logic, which is materially different from simply storing credentials in a vault. It also changes what auditors and platform owners need to inspect: not just who owns the account, but whether the entitlement ever exists outside the approved session window.

Practical implication: treat entitlement issuance as the control surface, not just credential storage.

Why ZSP is more than conventional PAM

The article positions ZSP as an additional layer beyond the familiar vault, isolate, and rotate model. That matters because vault-based PAM can secure secrets while still leaving privilege attached to the identity in a standing state. ZSP instead governs permissions and entitlements directly, which is closer to a least-privilege operating model for machine and service identities. For NHI governance, that distinction is important: a vaulted secret can still unlock broad access if the associated entitlement was never removed. ZSP narrows the blast radius by removing that persistent entitlement layer altogether.

Practical implication: assess whether your PAM design is protecting secrets without removing standing privilege.

Where JIT and ZSP diverge in practice

Just-in-time access and zero standing privileges overlap, but they are not identical in implementation or risk reduction. JIT can exist as a generic access pattern with different approval, timing, and lifecycle rules, while ZSP adds stricter entitlement governance and a clearer end state: zero standing privilege. The article also introduces TEA, or time, entitlements, and approval-based controls, to show that not all JIT variants behave the same way. For practitioners, the architectural question is whether the model enforces transient access by policy design or merely delays access through a workflow.

Practical implication: separate generic JIT workflows from true zero-standing entitlement controls.

NHI Mgmt Group analysis

ZSP is best understood as entitlement removal, not just controlled access. The article makes the important distinction that access is not merely delayed until use, but eliminated until explicitly issued. That matters because many NHI programmes still treat secret custody as the main control while leaving privilege attached. The governance question is whether the identity has any durable authority at rest, and ZSP answers that by design.

Standing privilege is now the more durable risk than the credential itself. Vaulting and rotation reduce exposure, but they do not automatically remove persistent entitlement from the identity model. When an NHI remains authorised all the time, the blast radius is defined by policy persistence, not by the secret lifecycle. Practitioners should read this as a signal that entitlement governance must be separated from secret management.

Zero standing privileges exposes a common control illusion in PAM programmes. Many environments can say a secret is managed while still allowing the identity to retain broad access. That creates a false sense of closure because the account looks controlled even though the underlying privilege never disappeared. The implication is that PAM maturity now depends on whether access can be made ephemeral, not just stored securely.

Ephemeral entitlement boundary: ZSP turns privilege into a time-scoped event rather than a persistent asset. That concept is increasingly central to NHI governance because it changes what ‘access review’ can even mean when the privilege exists only for a session. Practitioners should treat entitlement duration as a first-class governance variable.

ZSP should be evaluated as a policy design choice, not a universal architecture pattern. The article is careful to note that some scenarios, such as tenant creation flows, can be legitimate exceptions. That makes exception handling part of the control design, not a footnote. The practical conclusion is that ZSP programmes need governance for edge cases before they scale the model.

From our research library:

• 91% of organisations say at least half of their privileged access is always-on, and only 1% have fully implemented just-in-time privileged access, according to a CyberArk study.

What this signals

Standing privilege is the real control debt in many NHI programmes. If an identity remains entitled between uses, the organisation still carries dormant access risk even when passwords, tokens, or certificates are vaulted. The governance task is to make entitlement duration visible, because that is what determines whether privilege can truly be revoked.

Zero standing privilege turns access into a temporary state, not a property of the account. That shift changes how teams think about offboarding, access review, and exception handling for non-human identities. Programmes that keep using permanent entitlements with better wrappers will continue to miss the core problem.

ZSP becomes most useful when it is treated as a baseline, not a universal answer. Some workflows will still need exceptions, but those exceptions should be explicit, temporary, and governable. The signal for practitioners is to redesign privilege policy around issuance and expiry, not around static ownership.

For practitioners

• Define where standing privilege must be eliminated Map all non-human identities to identify which privileges can be removed entirely rather than merely vaulted or rotated. Prioritise service and workload accounts with broad entitlements that remain active between uses.
• Separate entitlement governance from secret management Review whether your current PAM design protects credentials while leaving the identity permanently authorised. Close the gap by managing when privilege exists, not only where secrets are stored.
• Classify legitimate exception paths Document scenarios where ZSP is not practical, such as tenant-level creation workflows, and define how those exceptions are approved, monitored, and removed so they do not become standing access.
• Test whether JIT is truly ephemeral Check whether your just-in-time process actually removes access after use or simply adds a workflow delay before the same entitlement reappears. If the privilege still persists outside the session, it is not ZSP.
• Align PAM controls to a zero-standing baseline Use your PAM programme to enforce ephemeral privilege as the desired state, then layer vaulting and rotation around that baseline rather than treating them as substitutes for entitlement removal.

Key takeaways

• Zero standing privilege addresses the persistence of NHI entitlements, which is often a bigger exposure than the credential itself.
• The article's key point is that ZSP can reduce risk, but it does not replace the need to choose the right control for each access scenario.
• Practitioners should use ZSP to reset the baseline for NHI access and then govern exceptions so they do not become permanent privilege.

Key terms

• Zero Standing Privileges (ZSP): A security posture where no identity, human or non-human, holds persistent access rights. Access is provisioned dynamically on demand and automatically revoked after use. ZSP is the gold standard for NHI access control.
• Just-in-Time Access Request: Just-in-Time Access Request is a pattern that grants access only when it is needed and only for the duration required. It reduces standing privilege by making access temporary, policy driven, and task scoped. This approach is especially useful for contractors, sensitive systems, and short-lived operational work.
• Standing Privilege: Standing privilege is access that remains active even when no immediate task requires it. For NHI programmes, it is a common failure mode because long-lived credentials and persistent roles create unnecessary exposure. Reducing standing privilege usually means tighter expiry, on-demand access, and clearer review of who or what still needs access.
• Entitlement Governance: Entitlement governance is the discipline of deciding who or what should have access, for how long, and under what business justification. It spans human users, non-human identities, and automated workflows, making it a core control layer for SaaS, cloud infrastructure, and lifecycle management.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.