Topic starter
11/06/2026 10:50 pm
TL;DR: Temporary, non-privileged access and elevated administrative access need different controls, even when both use JIT and least privilege, according to JumpCloud. The practical lesson is that access governance fails when organisations treat ordinary request workflows and high-risk privileged sessions as the same problem.
Editorial analysis by NHI Mgmt Group, based on content published by JumpCloud: “The Two Sides of Access Control: JumpCloud Access Request and Privileged Access Management (PAM)”.
Key questions
Q: How should security teams separate IAM and PAM in practice?
A: Treat IAM as the baseline control for identity proofing, routine access, and lifecycle governance, then add PAM for accounts that can change systems, access sensitive data, or escalate risk.
Q: Why does least privilege need different controls for admins and regular users?
A: Because the risk is not the same.
Q: What breaks when organisations treat JIT as a single access model?
A: The governance model breaks at the point where temporary access is assumed to be enough for every role.
Practitioner guidance
- Separate request workflows from privileged session governance Use access requests for temporary non-privileged permissions and reserve PAM for administrator, root, and high-impact system access.
- Vault and rotate privileged credentials Keep Windows passwords and SSH keys for privileged accounts in a vault, and rotate them automatically so users never handle reusable secrets directly.
- Require session recording for elevated access Record commands and screen activity for privileged sessions so the audit trail captures what happened after access was granted, not only who approved it.
Bottom line: Access requests and PAM solve different access problems, even though both can use JIT and least privilege.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 4 days ago by NHI Mgmt Group
12/06/2026 7:12 am
Least privilege is being overloaded when organisations collapse request workflows and privileged sessions into one governance model. The article shows two different identity problems: temporary business access and elevated administrative control. One is about entitlement delivery, the other is about protecting the keys to critical systems. Practitioners should stop treating “JIT access” as a single design pattern and instead govern it by risk class.
A few things that frame the scale:
- 97% of NHIs carry excessive privileges, increasing unauthorised access and broadening the attack surface, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: When should teams use PAM instead of a normal access request?
A: Use PAM whenever the access path reaches sensitive infrastructure, administrative consoles, or any system where a single session can create broad operational impact. A normal access request is appropriate for routine resource access, but it does not provide the same containment, visibility, or credential protection that privileged work requires.
👉 Read our full editorial: Access requests vs PAM: what least privilege really means
This post was modified 4 days ago by NHI Mgmt Group