Security teams should broker privileged access directly on the target resource, not proxy all traffic through the access platform. That approach preserves normal user connectivity, avoids a single point of failure, and reduces the need for firewall changes or port exposure. The practical goal is to separate authorization from session transport while still enforcing JIT approval, expiry, and revocation on the underlying resource.
Why this architecture avoids the bottleneck
The key design choice is to keep the access decision close to the protected system and keep the session path off the access platform’s hot path. That means the platform can approve, bind, and expire access without becoming the tunnel for every packet, which is what usually creates latency, routing complexity, and an avoidable failure domain in private and hybrid environments.
This approach works because JIT is fundamentally about controlling authority, not rewriting transport for the entire session. The access control plane should decide whether a user can connect now, for how long, and to which resource, while the network path should remain as direct as the environment allows. For teams extending access across cloud, on-prem, and segmented networks, that separation is often the difference between scalable JIT and a system that collapses under its own proxy overhead.
When teams force all traffic through a central proxy, they often end up solving the wrong problem. They reduce one risk, standing privilege, while introducing others such as throughput choke points, harder troubleshooting, and brittle dependence on firewall choreography. Direct brokered access preserves the normal application path and keeps the access platform focused on authorization and revocation rather than bulk traffic handling.
What to preserve in private and hybrid environments
A workable implementation needs three things: a control point that can issue short-lived approval, a resource-side enforcement point that can honor that approval, and an audit trail that ties the session to the request. In practice, that usually means the target system, gateway, or adjacent enforcement layer accepts the JIT decision and enforces expiry locally instead of forcing every connection through a remote inspection tunnel.
That model is especially useful where firewall rules, NAT paths, or legacy network zones make “central proxy everything” operationally expensive. If the access flow requires repeated rule changes, port openings, or custom routing exceptions just to start a session, the design is too dependent on the transport layer. A better pattern is to keep connectivity predictable and let the privilege state change, not the route.
Teams should also think carefully about failure isolation. If the approval workflow, policy engine, or identity provider is unavailable, the safest outcome is usually that new elevation requests fail closed, while already-authorized sessions continue until their expiry boundary. That gives you control without turning transient control-plane issues into a broad connectivity outage.
Risk and Threat Considerations
Centralizing all privileged traffic through a single access proxy creates a concentration risk: if that path is slow, misconfigured, or unavailable, routine administration can stall across many systems at once. It also enlarges the blast radius of a compromise because attackers who gain control of the broker or its policy path may inherit visibility into, or influence over, multiple downstream sessions.
Failure mechanism: The access platform becomes both the policy authority and the traffic transit layer, so any capacity issue, routing defect, or compromise affects authorization and session delivery at the same time.
Impact: Teams see bottlenecks, fragile maintenance windows, and a single chokepoint that can disrupt access to private and hybrid resources, or magnify the effect of a broker-side security failure.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 address the attack and risk surface, while NIST CSF 2.0, NIST Zero Trust (SP 800-207), CIS Controls v8 and NIST SP 800-63 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST CSF 2.0 | PR.AC — Access Control | JIT access extension is an access-control design problem. |
| Recommendation — Enforce least-privilege, time-bound access and revoke it automatically at expiry. | ||
| NIST Zero Trust (SP 800-207) | SC-2 — Zero Trust Architecture | Direct brokered access aligns with policy-enforced access without trusting the network path. |
| Recommendation — Place policy enforcement close to the protected resource and avoid trusting a central transit path. | ||
| CIS Controls v8 | 6 — Access Control Management | The question is about controlling privileged access without introducing brittle network dependencies. |
| Recommendation — Restrict privileged access paths and manage approvals, expirations, and revocations centrally. | ||
| NIST SP 800-63 | IAL — Identity Proofing and Enrollment Assurance | JIT elevation depends on trustworthy identity assurance before access is granted. |
| Recommendation — Verify requester identity assurance before issuing time-bound privileged access. | ||
| OWASP Non-Human Identity Top 10 | NHI-01 — Secrets and Credential Management | Hybrid JIT often relies on short-lived credentials and controlled session material. |
| Recommendation — Use short-lived credentials and rotate or revoke access material at expiry. | ||
Practitioner Guidance
What to verify: Confirm that the JIT decision is enforced on the target resource or a near-resource control point, not by hairpinning all traffic through the access platform. You want proof that approval, expiry, and revocation work independently of the session transport path.
Common mistake: Treating the proxy as the security boundary instead of the policy boundary. That shortcut often looks simpler at first, but it creates avoidable latency and makes every access session dependent on the same infrastructure component.
Trade-off: Direct brokered access usually requires more careful coordination with network, platform, and system owners, but it scales better than a universal tunnel when you need to support private and hybrid estates without constant firewall change requests.
Practitioner takeaway: The best JIT design is the one that keeps privilege ephemeral while keeping the network path ordinary, because scalable access control depends on separating authorization from transport.
Related resources from NHI Mgmt Group
- How should security teams enforce just-in-time access across privileged users, cloud identities, and AI agents without creating separate control planes?
- How should security teams implement manager approval workflows for infrastructure access without creating bottlenecks?
- How should security teams extend privileged access controls to endpoints without creating standing access sprawl?
- How should security teams extend identity and access controls across human users, infrastructure, cloud workloads, and AI agents without creating four separate operating models?
Deepen Your Knowledge
Reviewed and updated by the NHIMG editorial team on September 18, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org
