Topic starter
22/06/2026 10:16 am
TL;DR: Just-in-time access has shifted from a privileged-user control to a broader governance pattern for people, cloud services, pipelines, and agents, with Delinea arguing that standing privilege now creates unnecessary risk across both audiences. The deeper issue is that access review, offboarding, and audit models built around persistent credentials no longer fit ephemeral access patterns or autonomous execution loops.
Editorial analysis by NHI Mgmt Group, based on content published by Delinea: “How to satisfy the two audiences of just-in-time privileged access”.
Key questions
Q: How should security teams audit privileged access across human and non-human identities?
A: They should start with a complete privileged identity inventory that includes administrators, service accounts, API keys, certificates, pipeline credentials, and vendor accounts.
Q: Why do certificates create risk in cloud and automation environments?
A: Certificates create risk when they outlive the workloads, pipelines, or data paths they were meant to protect.
Q: What breaks when just-in-time access is applied only to users and not permissions?
A: The permission surface stays standing even if the login path is gated.
Practitioner guidance
- Define JIT eligibility by actor type Separate human privileged users from service accounts, workloads, pipelines, and agents, then set distinct rules for who can request elevation, under what task context, and for how long.
- Eliminate standing privilege for automation Identify long-lived secrets attached to CI/CD, cloud consoles, databases, Kubernetes, and internal services, then replace persistent access paths with time-bound issuance and expiry.
- Keep native workflows intact Preserve SSH, kubectl, database clients, and existing developer tools so that short-lived access is delivered underneath familiar workflows rather than through a separate portal.
Bottom line: Just-in-time access is no longer only about human administrators, because workloads and automation now hold privilege that can be just as dangerous when left standing.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
22/06/2026 11:05 am
Just-in-time access has become a governance model for two identity populations, not one. The article correctly shifts JIT from a human-admin control to a shared pattern for people, workloads, pipelines, and agents. That matters because privileged access now exists wherever execution happens, not only where a person logs in. The practitioner conclusion is that privilege governance must be designed around the actor type actually holding the access.
A few things that frame the scale:
- 42% of machine identities have privileged access and 61% of organisations lack identity security controls for cloud workloads, according to CyberArk's 2025 Identity Security Landscape.
- 71% of NHIs are not rotated within recommended time frames, increasing the risk of compromise over time, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: How do teams balance JIT controls with developer productivity?
A: By keeping the tools and protocols developers already use while changing the credential lifetime behind the scenes. If JIT replaces SSH, kubectl, or database clients with a separate portal, users route around it and the control loses both adoption and security value.
👉 Read our full editorial: Just-in-time privileged access is now a control for two audiences