Topic starter
15/08/2026 6:08 pm
TL;DR: The biggest barrier to privileged cloud access is workflow friction, not policy, according to Britive, and embedding ephemeral JIT access and approvals directly in the browser can reduce ClickOps resistance across AWS, Azure, and GCP. The underlying issue is that traditional PAM often fails because controls that interrupt the engineer’s flow get bypassed or automated around.
Editorial analysis by NHI Mgmt Group, based on content published by Britive: “Eliminating Security Friction: Enabling Ephemeral Cloud Access Directly in the Browser”.
Key questions
Q: What breaks when privileged access workflows are too friction-heavy?
A: When privileged access workflows are too friction-heavy, engineers often respond by requesting broader access than they actually need.
Q: Why do JIT and Zero Standing Privileges fail when approvals are too slow?
A: They fail because the access path becomes more expensive than the work it is meant to enable.
Q: How can security teams prove PAM is working?
A: Look for shorter onboarding, faster privilege escalation, quicker revocation, and less time spent gathering audit evidence.
Practitioner guidance
- Align privileged access with the work surface Evaluate whether cloud privilege checkout can happen inside the browser, console, or other native workflow surface used by engineers.
- Shorten the JIT request path Map every manual step between a request and a usable cloud session, then remove steps that do not add a governance decision.
- Instrument approval latency and bypass behaviour Track how long requests take, where approvers stall, and whether teams are using shadow workarounds such as direct console access or side-channel approvals.
Bottom line: The article argues that PAM failures in cloud environments are often caused by workflow friction rather than a lack of policy intent.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
15/08/2026 6:16 pm
Browser proximity is becoming a PAM adoption control, not a convenience feature. When privileged access sits in a separate workflow, engineering teams experience it as interruption rather than governance. That makes the control easier to bypass, especially in cloud environments where speed is part of the delivery model. The practitioner takeaway is that access architecture now has to account for where work happens, not just who is authorised.
A few things that frame the scale:
- 97% of NHIs carry excessive privileges, increasing unauthorised access and broadening the attack surface, according to the Ultimate Guide to NHIs.
- Only 44% of developers are reported to follow security best practices for secrets management, exposing a significant developer behaviour gap, according to the State of Secrets in AppSec.
A question worth separating out:
Q: Should organisations keep privileged access in a separate portal or move it closer to the browser?
A: If the separate portal creates enough friction that engineers bypass it, the control is too detached from daily work. Moving request and approval closer to the browser can improve compliance, but only if the approval decision, time limit, and audit trail remain governed. Convenience is acceptable only when accountability stays intact.
👉 Read our full editorial: Browser-embedded ephemeral cloud access changes PAM adoption