Topic starter
14/08/2026 6:34 pm
TL;DR: JIT access often looks healthy on dashboards while privileged work still moves through break-glass accounts, shared admin credentials, and informal bypasses, according to Twine Security. The real control failure is not emergency access itself but the missing return path and approval theatre that leave standing privilege intact.
Editorial analysis by NHI Mgmt Group, based on content published by Twine Security: “Your JIT Access Program Is Probably a Break-Glass Program”.
Key questions
Q: What breaks when a JIT access programme relies on break-glass and shared admin credentials?
A: The programme stops governing the access that matters.
Q: Why do emergency access paths create risk even when they help during incidents?
A: They create risk when they remain available after the incident or when they become the default route for routine work.
Q: How do you know if JIT access is actually working?
A: Look for short-lived sessions, complete approval records, and reliable revocation evidence.
Practitioner guidance
- Measure privileged actions outside the JIT path Inventory break-glass accounts, shared admin credentials, and standing production access, then compare their use against approved JIT requests each month.
- Design an explicit return condition Define the event that ends temporary access, such as incident closure or rollback completion, and automate revocation when that condition is met.
- Separate emergency access from routine operations Restrict break-glass access to genuine emergencies and require post-use justification so routine work does not migrate into the bypass path.
Bottom line: JIT access programmes often fail because the visible workflow is not the same as the privileged path people actually use.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
14/08/2026 6:42 pm
Approval workflow visibility is not privileged access governance: A JIT programme can record every request and still fail to govern the access that matters. The control boundary is the privilege actually used, not the ticket that was approved. That distinction is what separates a functioning lifecycle process from a reporting layer. Practitioners should treat hidden bypass paths as part of the identity estate, not exceptions outside it.
A few things that frame the scale:
- 91% of organisations say at least half of their privileged access is always-on, and only 1% have fully implemented just-in-time privileged access, according to a CyberArk study.
A question worth separating out:
Q: Should organisations manage JIT, PAM, and break-glass as one access governance problem?
A: Yes. They are different control patterns, but they govern the same privileged lifecycle. If teams separate them operationally, they often miss the gap between approved access and actual access use, which is where bypasses and entitlement sprawl accumulate.
👉 Read our full editorial: Jit access fails when break-glass becomes the real control