Notifications
Clear all
Topic starter
17/08/2026 4:39 pm
TL;DR: Just-in-time access fails when approval logic, role scope, and expiry rules are bolted on separately, according to Teleport’s analysis of common JIT pain points and least-privilege workflows. The real issue is that access governance still assumes elevation is a rare exception, when ephemeral privilege now has to operate as a native identity control.
NHIMG editorial — based on content published by Teleport: How Teleport Simplifies Just-in-Time Access
By the numbers:
- Only 44% of organisations have implemented any policies to manage their AI agents, despite 92% agreeing that governing AI agents is critical to enterprise security.
- 70% of organisations grant AI systems more access than they would give a human employee performing the exact same job.
- Systems with least-privileged AI access had a 17% incident rate vs 76% for over-privileged systems, meaning organisations failing to scope AI access properly are 4.5x more likely to experience a security incident.
Questions worth separating out
Q: How should security teams implement just-in-time privileged access in cloud environments?
A: Start with the most sensitive administrative paths, then require approval, session bounds, and automatic expiry for each elevation event.
Q: Why do access control models still fail in mature IAM programmes?
A: They fail when the programme focuses on granting access but not on removing it.
Q: What breaks when just-in-time access is bolted onto broad admin roles?
A: Broad admin roles turn JIT into temporary over-privilege instead of least privilege.
Practitioner guidance
- Map every privileged path to a requestable role Inventory who can request access to SSH, Kubernetes, databases, cloud consoles, and internal apps, then confirm the requestable roles are tightly bounded by resource scope and deny rules.
- Automate expiry at the identity service Set access duration from policy and session constraints so elevated access expires automatically without manual revocation tasks or help desk intervention.
- Bind approvals to contextual evidence Require ticket IDs, reason prompts, or on-call status before elevation is approved, and reject any request that cannot be tied to an auditable operational need.
What's in the full article
Teleport's full article covers the operational detail this post intentionally leaves for the source:
- Role-by-role configuration examples for requestable access paths across infrastructure systems
- Approval rule examples using ticket prompts, reviewer thresholds, and on-call integrations
- Access duration logic that determines when elevated access begins and how it expires
- Centralised audit logging across SSH, Kubernetes, databases, and cloud consoles
👉 Read Teleport's analysis of just-in-time access and least-privilege workflows →
Just-in-time access governance: are your approvals and expiry rules aligned?
Explore further
View Full Forum → | NHI Foundation Course → | Our Services →
17/08/2026 4:44 pm
JIT access fails when organisations treat elevation as an exception instead of a governed identity state. The article shows why bolted-on JIT controls struggle in cloud-native environments: request, approval, and expiry must behave like one policy system, not separate workflow steps. That is especially true when privileged access spans humans and infrastructure identities, because the same standing-access problem appears across PAM, NHI, and platform operations. The practitioner conclusion is that elevation must be designed as a first-class identity state, not an ad hoc override.
A few things that frame the scale:
- Only 44% of organisations have implemented any policies to manage their AI agents, despite 92% agreeing that governing AI agents is critical to enterprise security, according to The 2026 Infrastructure Identity Survey.
- In the same survey, 70% of organisations grant AI systems more access than they would give a human employee doing the same job, which shows how quickly policy and practice diverge.
A question worth separating out:
Q: How do security teams know if just-in-time access is actually working?
A: Look for short-lived sessions, automatic revocation, and complete request-to-access logs. If approvals are still creating durable permissions, or if teardown depends on manual cleanup, then the programme is only partially ephemeral. Effective JIT should leave little or no reusable privilege behind after the task ends.
👉 Read our full editorial: Just-in-time access only works when policy, approval, and expiry align
