JIT access and micro-reviews: what IAM teams should copy

TL;DR: Instacart reports eliminating standing AWS access, extending just-in-time controls to sensitive apps like Stripe, and completing nearly 70,000 automated IAM tasks while reducing access-review effort, according to ConductorOne. The real shift is not speed alone: access governance now assumes entitlement windows are ephemeral, auditable, and policy-driven rather than persistently granted.

NHIMG editorial — based on content published by ConductorOne: So Long, Standing Access: Inside Instacart’s Just-In-Time Access Playbook

By the numbers:

• 90% of IT leaders say properly managing NHIs is essential for a successful zero-trust implementation.
• Only 5.7% of organisations have full visibility into their service accounts.

Questions worth separating out

Q: How should security teams replace standing access without slowing down work?

A: Start by identifying which entitlements are truly task-bound and which are simply inherited habit.

Q: Why do short-lived access models matter more for NHIs than traditional reviews?

A: NHIs often act faster than human review cycles can observe.

Q: What breaks when access reviews are treated as a quarterly checkbox?

A: Quarterly reviews assume access remains stable long enough to be meaningfully assessed later.

Practitioner guidance

• Replace standing access with expiry-backed entitlements Inventory privileged AWS and application access, then attach explicit expiration to every sensitive entitlement so renewal becomes the exception rather than the default.
• Move access review evidence into source control Version policy logic, approval rules, and entitlement changes in Git so auditors can inspect the control history instead of reconstructing it from tickets.
• Use usage data to define personas and renewals Analyse request patterns by team, role, and entitlement reuse, then adjust policies so frequent, low-risk requests can be handled consistently while unused access naturally falls away.

What's in the full article

ConductorOne's full blog covers the operational detail this post intentionally leaves for the source:

• The Terraform-backed policy workflow Instacart used to encode approvals, roles, and audit trails in code.
• The request and renewal paths through Slack, UI, and CLI that made the JIT programme usable for engineers and business teams.
• The entitlement scoring approach behind Gadjit, including the factors used to rank requests and support auto-approval.
• The advice Instacart shared for sequencing rollout, including dual-path adoption and persona building from usage data.

👉 Read ConductorOne's blog on Instacart’s just-in-time access playbook →

JIT access and micro-reviews: what IAM teams should copy?

Explore further

View Full Forum →  |  NHI Foundation Course →