On-call access management and the standing privilege problem

TL;DR: Opal Security shows that permanent production access for on-call engineers weakens least privilege and expands blast radius, while fully manual request handling can slow incident response and raise operational burden. Time-bound access tied to on-call state is the governance shift that makes security and agility compatible.

Editorial analysis by NHI Mgmt Group, based on content published by Opal Security: “How to Automate On-Call Access Management with Opal and PagerDuty”.

Key questions

Q: What breaks when on-call engineers have permanent production access?

A: Permanent production access breaks least privilege because responders keep elevated rights long after the incident window has ended.

Q: Why does tying access to on-call status reduce risk?

A: It reduces risk because the entitlement exists only while the engineer is actively responsible for the response.

Q: How can teams tell whether access governance is actually working?

A: Look for short revocation times, low rates of stale entitlements, and repeatable access review outcomes across systems.

Practitioner guidance

• Define on-call access as an ephemeral entitlement Bind production access to active on-call status rather than permanent group membership, and revoke it automatically when the engineer is off-call.
• Replace birthright admin access with scoped resource bundles Map the minimum production resources needed for triage and package them into a controlled on-call access group instead of broad administrator rights.
• Integrate scheduling data with access issuance Use incident rota information as the trigger for privilege elevation so the access window follows the responder role instead of the job title.

Bottom line: Permanent production access for responders weakens least privilege and creates a larger blast radius than the on-call use case requires.

What's in the full article

Opal Security's full article covers the operational detail this post intentionally leaves for the source:

• How Opal structures on-call access groups with native integrations
• How PagerDuty schedule state is used to grant and revoke privileged access
• The old way versus the new way for production permissions and on-call responders
• The integration documentation that supports implementation details for teams adopting the workflow

👉 Read Opal Security's analysis of on-call access management and standing privilege →

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →