What breaks when organisations JIT users instead of permissions?

Why This Matters for Security Teams

JIT is meant to reduce exposure, but it only works when the thing being time-boxed is the actual permission, not a user object that still inherits broad entitlements. When teams “JIT users,” they often leave role memberships, nested groups, and sync latency untouched, so the account becomes temporarily active while the underlying privilege model remains wide open. That mismatch defeats the purpose of just-in-time access and can create a false sense of control.

This matters because modern identity sprawl already makes privilege hard to see and harder to revoke. NHI Management Group notes that only 5.7% of organisations have full visibility into their service accounts in the Ultimate Guide to NHIs, and the broader Ultimate Guide to NHIs — Key Challenges and Risks shows how hidden privilege and weak lifecycle control turn access reviews into theatre. Current guidance from the OWASP Non-Human Identity Top 10 reinforces that identity controls fail when credential scope and entitlement scope are treated as the same problem.

In practice, many security teams discover that “temporary access” still behaves like standing privilege only after a routine approval has already been abused.

How It Works in Practice

Effective JIT controls are built around permissions, not around inflating or activating the user account itself. The control plane should issue narrowly scoped access only for a specific task, bind that access to a short TTL, and revoke it automatically when the task ends. That means the entitlement is created, evaluated, and removed at runtime rather than pre-staged through a broad role. This is especially important where access is mediated through PAM, because the session wrapper is not the same thing as privilege reduction.

A practical implementation usually combines several layers:

• Approval or policy decision at request time, not a permanent entitlement grant.
• Short-lived credential issuance with automatic revocation when the task or session ends.
• Detachment from static groups or nested roles that persist after the JIT window closes.
• Audit logs that record the exact permission granted, not just that a user was enabled.
• Verification that downstream systems honour revocation immediately, not on the next sync cycle.

For NHI-heavy environments, the same logic should be applied to workload identities, because static access patterns do not reflect how autonomous services actually behave. The NHIMG research on key challenges and risks highlights why excessive privilege and weak lifecycle management become persistent attack paths, while the OWASP Non-Human Identity Top 10 underscores the need to treat credential scope, session scope, and entitlement scope as separate controls. NIST’s access governance guidance under the NIST identity model also supports time-bounded, least-privilege access decisions.

These controls tend to break down in directory-heavy environments with delayed group propagation, shared admin accounts, or legacy applications that cache permissions after revocation.

Common Variations and Edge Cases

Tighter JIT controls often increase operational overhead, requiring organisations to balance reduced exposure against approval latency, integration effort, and user friction. That tradeoff is real, especially where teams need rapid incident response or where legacy systems cannot consume fine-grained entitlements cleanly.

There is no universal standard for this yet, but current guidance suggests treating the following cases differently:

• Shared accounts: JIT on the account does not remove inherited privilege, so access should be redesigned before JIT is relied on.
• Nested groups: membership changes may lag, meaning the user can retain access after the JIT window closes.
• Automation accounts: the correct unit is often a short-lived permission or token, not a human-style user activation workflow.
• Emergency access: break-glass procedures may justify broader scope, but they need separate controls and stronger monitoring.

For organisations managing secrets and non-human identities together, the Ultimate Guide to NHIs is useful because it frames JIT as part of a broader lifecycle problem, not a standalone fix. The key operational lesson from the OWASP Non-Human Identity Top 10 is that a short session with broad entitlement is still broad entitlement.

In environments with asynchronous sync, cached authorization, or application-layer privilege reuse, JIT users often remain effectively privileged long after the nominal access window has expired.

Related resources from NHI Mgmt Group

• What breaks when organisations rely only on periodic access reviews?
• When does JIT access create more risk than it reduces?
• How do organisations operationalise NHI ownership at scale?
• When should organisations treat an NHI as a high-priority risk?