Topic starter
25/06/2026 12:32 am
TL;DR: Agent-based PEDM shifts privilege enforcement to the host, eliminating routine standing access and narrowing elevation to specific actions, while agentless IdP-centric models still leave persistent roles and session-wide exposure, according to Delinea. The unresolved issue is that ZSP assumptions built around directory-held privilege and upstream MFA do not fully hold when enforcement stops at the identity provider.
Editorial analysis by NHI Mgmt Group, based on content published by Delinea: “Why agent-based PEDM is the only path to Zero Standing Privilege”.
Key questions
Q: What breaks when privilege elevation is handled only in the identity provider?
A: The model breaks when the IdP is treated as the only enforcement point, because the host still receives a broad elevated session that it cannot independently challenge.
Q: When does just-in-time elevation still leave excessive risk?
A: It still leaves excessive risk when the entire session receives admin rights and the server cannot scope privilege to one command or process.
Q: How should security teams reduce the blast radius of privileged identities?
A: Security teams should define a small set of tightly governed admin identities, give them the minimum authority needed, and make elevation time bound.
Practitioner guidance
- Separate approval from enforcement Use the identity provider for authentication and request workflow, but require the server or endpoint to make the final elevation decision for privileged actions.
- Restrict routine use of privileged accounts Disable built-in administrator and root accounts for daily login, then reserve them for audited break-glass use only.
- Scope elevation to the process level Grant elevation to the specific installer, command, or service task instead of applying admin rights to the whole session.
Bottom line: The article argues that agentless zero standing privilege still leaves residual standing roles and session-wide exposure, so the control is weaker than the label suggests.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
25/06/2026 9:28 am
Agentless ZSP is risk reduction, not privilege elimination: When the privileged identity still lives in the directory, the organisation has not removed standing privilege, only wrapped it in a temporary workflow. That distinction matters because the attacker still has a durable target. The practitioner conclusion is simple: the control state must be judged by where privilege exists, not by how quickly it expires.
A few things that frame the scale:
- 97% of NHIs carry excessive privileges, increasing unauthorised access and broadening the attack surface, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: What is the difference between agentless ZSP and host-level PEDM?
A: Agentless ZSP changes how access is granted, while host-level PEDM changes where privilege is enforced. The first can still rely on directory-held roles and upstream approval, but the second lets the resource itself validate and scope the privileged action.
👉 Read our full editorial: Agent-based PEDM and the limits of agentless zero standing privilege