Topic starter
15/08/2026 6:07 pm
TL;DR: Zero Trust secures the path to a resource, but it does not govern what an identity can do after arrival, according to Britive, which is why the article argues that Zero Standing Privileges is needed to remove persistent admin power and limit blast radius across users, workloads, and autonomous AI pipelines. Persistent access, not just network exposure, remains the control gap.
Editorial analysis by NHI Mgmt Group, based on content published by Britive: “Zero Trust and Zero Standing Privileges: Why Network Control Is Only Half the Battle”.
Key questions
Q: What breaks when least privilege is not enforced in a zero trust model?
A: The model stops containing blast radius.
Q: Why do standing privileges increase security risk even when access appears legitimate?
A: Standing privilege creates a long exposure window.
Q: How do security teams know if just-in-time access is actually working?
A: Look for short-lived sessions, automatic revocation, and complete request-to-access logs.
Practitioner guidance
- Define separate controls for connectivity and privilege Map where Zero Trust ends and privilege enforcement begins in your cloud, workload, and agent pathways.
- Eliminate persistent admin roles Inventory cloud IAM policies, database credentials, and service account grants that remain valid between tasks, then replace them with task-scoped issuance and automatic revocation.
- Shift to runtime authorization for machine actors For workloads and autonomous agents, evaluate access at execution time using request intent, scope, and duration rather than relying on fixed entitlements set during provisioning.
Bottom line: Zero Trust reduces exposure at the connection layer, but standing privilege still creates an operational path to excess authority.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
15/08/2026 6:15 pm
Zero Trust is necessary but structurally incomplete when privilege remains standing: the model was designed to decide whether an identity may reach a resource, not to govern the authority it carries once connected. That leaves a persistent privilege layer outside the control boundary. In cloud estates, the result is a secure path to excessive power rather than a secure environment. The practitioner conclusion is that connectivity control and privilege control are different disciplines.
A few things that frame the scale:
- 90% of IT leaders say properly managing NHIs is essential for a successful zero-trust implementation, according to the Ultimate Guide to NHIs.
- 91% of organisations say at least half of their privileged access is always-on, and only 1% have fully implemented just-in-time privileged access, according to a CyberArk study.
A question worth separating out:
Q: How should organisations govern workloads and AI agents that act continuously?
A: They should authorise those actors at execution time, not only at provisioning time. Workloads and AI agents can perform multiple actions within a single session, so fixed entitlements overstate what they need. Runtime authorization and ephemeral privilege match their behaviour more closely than static access reviews do.
👉 Read our full editorial: Zero trust leaves a privilege gap that zero standing access must close