Topic starter
25/06/2026 12:23 am
TL;DR: Just-in-time access narrows privilege windows for people, machines, APIs, and AI models by granting access only when needed and revoking it afterward, according to Delinea. That reduces exposure, but it also exposes the governance burden of policy design, approval logic, and auditability across mixed identity types.
Editorial analysis by NHI Mgmt Group, based on content published by Delinea: “Just-in-time access: Strengthening security in a zero-trust world”.
Key questions
Q: What breaks when just-in-time access is not revoked reliably?
A: The control becomes standing privilege with a temporary label, which means the security benefit disappears after the approval window closes.
Q: When should organisations replace standing privilege with just-in-time access?
A: Organisations should replace standing privilege with just-in-time access whenever elevated access is not required continuously.
Q: How do security teams know whether JIT access is actually reducing risk?
A: Look for shorter credential lifetime, fewer always-on permissions, and lower exposure of credentials in code, pipelines, and runtime environments.
Practitioner guidance
- Define task-scoped elevation policies Set explicit rules for which roles, systems and actions can receive temporary privilege, including time limits and contextual conditions such as risk or device posture.
- Replace standing machine credentials Move service accounts, APIs, bots and AI workflows to short-lived credentials that expire automatically after the approved task completes.
- Instrument revocation and audit trails Log every approval, privilege grant and automatic revocation so reviewers can reconstruct who had access, when they had it and why it was issued.
Bottom line: Just-in-time access reduces the exposure created by standing privilege, but the control only works when expiry and revocation are reliably enforced.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
25/06/2026 9:18 am
JIT access is only a privilege-control pattern if the lifecycle is actually enforced. The article correctly frames the value of short-lived access, but the security outcome depends on whether elevation, expiry and revocation are all machine-held states rather than policy aspirations. Where revocation is delayed or approval is too broad, JIT becomes a naming convention for standing privilege with a shorter lease. Practitioners should evaluate the enforced lifecycle, not the label.
A few things that frame the scale:
- 90% of IT leaders say properly managing NHIs is essential for a successful zero-trust implementation, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: What happens when service accounts and AI models use JIT access?
A: The same governance problem moves from human privilege management to runtime identity issuance. Teams must control when the non-human identity receives access, what it can reach during execution, and whether the credential disappears before the next task starts.
👉 Read our full editorial: Just-in-time access and the limits of zero standing privilege