Topic starter
24/06/2026 9:13 pm
TL;DR: Admin time authorization assigns roles and permissions before access is attempted, which keeps enterprise access predictable, auditable, and easy to govern, according to Cerbos. The static model still matters, but it breaks down when context, risk, and lifecycle changes outpace periodic reviews and role updates.
Editorial analysis by NHI Mgmt Group, based on content published by Cerbos: “What is admin-time / static authorization?”.
Key questions
Q: Where does admin time authorization fail in practice?
A: It fails when a static role is being asked to represent conditions that change after provisioning.
Q: Why do static roles create over-privilege in enterprise systems?
A: Because the role remains valid until someone changes it, even if the user’s work has changed.
Q: How do teams know when runtime authorization is needed?
A: Runtime authorization is needed when the question is not just who the user is, but what is true at the moment of access.
Practitioner guidance
- Define a static access baseline Keep role and group assignment for stable job functions, separation of duties, and onboarding so the access model remains auditable and understandable.
- Move context-sensitive decisions to runtime Use policy evaluation for location, ownership, time, or risk-based decisions instead of encoding those conditions as permanent roles.
- Reduce role explosion Consolidate specialised roles where they are only compensating for missing runtime rules, then remove entitlements that duplicate business context.
Bottom line: Admin time authorization remains the baseline for enterprise access because it gives administrators a stable way to assign and audit roles.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
25/06/2026 6:18 am
Admin time authorization is the governance floor, not the decision engine. It gives identity teams a stable way to assign baseline access, document entitlements, and support separation of duties. That makes it indispensable in enterprise IAM, but only as the starting point for control design, not the end state. Practitioners should treat it as the provisioning layer that runtime policy must refine.
A question worth separating out:
Q: How should organisations combine IAM governance with dynamic policy?
A: Use IAM and IGA to govern baseline entitlements, approvals, and reviews, then use runtime policy to decide whether a permitted identity can act in the current context. This keeps the audit trail anchored in roles while ensuring the actual access decision reflects live conditions. The result is tighter least privilege without losing administrative clarity.
👉 Read our full editorial: Admin time authorization is still the baseline for enterprise access