What is the difference between zero standing privilege and periodic access review?

Why This Matters for Security Teams

zero standing privilege and periodic access review both aim to reduce exposure, but they operate at different points in the control lifecycle. ZSP prevents privilege from existing by default, while periodic review only tests whether existing access still looks justified. That distinction matters most for NHI environments, where service accounts, API keys, CI/CD identities, and workload tokens can stay active far longer than anyone intends. In NHI governance guidance from Ultimate Guide to NHIs, long-lived privilege is treated as an attack surface problem, not just a compliance problem. OWASP’s OWASP Non-Human Identity Top 10 similarly frames persistent identity exposure as a recurring root cause of misuse and compromise.

Periodic access review is still useful, especially for proving ownership and finding orphaned access, but it is a detective control. ZSP is preventive: it changes the default so elevated access must be earned, time-bound, and purpose-specific. That is why organisations often pair reviews with JIT elevation, approval workflows, and strong offboarding. The difference is not academic. It determines whether excess access exists briefly under control or continuously until the next review cycle. In practice, many security teams encounter privilege creep only after a workload or automation account has already been over-permissioned for months.

How It Works in Practice

In a ZSP model, the identity starts with no standing elevation. When a task requires more access, the system grants it just in time, for a narrow scope and a short duration, then revokes it automatically. That approach fits better with NHI governance because machine identities often act at high speed and at scale. The relevant design pattern is described across the NHI Lifecycle Management Guide and the Ultimate Guide to NHIs — Key Challenges and Risks, where persistent credentials and weak lifecycle discipline are treated as primary failure modes.

Periodic access review, by contrast, asks whether an entitlement should remain on the books. It does not change the fact that the entitlement existed between review dates. That is why review programs are strongest when they are used to clean up exceptions, validate ownership, and retire stale access after the fact. For machine identities, current guidance suggests combining review with technical enforcement: vault-backed secrets, expiring tokens, workload identity, and policy-based approvals. The OWASP Non-Human Identity Top 10 is a useful reference for controlling standing access, while the 52 NHI Breaches Analysis shows how identity failures often compound once credentials are left active too long.

• ZSP is preventive and time-bound; periodic review is detective and retrospective.
• ZSP works best when paired with JIT approvals and short-lived secrets.
• Reviews remain important for governance, exception handling, and auditability.
• For NHIs, workload identity and automated revocation reduce reliance on static standing access.

These controls tend to break down when service accounts are embedded in legacy apps or CI/CD pipelines that cannot request elevation dynamically because the workflow depends on always-on credentials.

Common Variations and Edge Cases

Tighter privilege controls often increase operational overhead, requiring organisations to balance speed of delivery against reduction in standing access. That tradeoff is especially visible where platforms need uninterrupted machine-to-machine communication or where ownership is fragmented across DevOps, security, and application teams. There is no universal standard for this yet, but best practice is evolving toward context-aware approvals, shorter token lifetimes, and stronger lifecycle automation rather than relying on calendar-based access checks alone.

Some teams use periodic access review as a compensating control when ZSP is not technically feasible. That is acceptable as a transition measure, but it should be treated as a gap, not a destination. Reviews can confirm whether an entitlement still has business value, but they cannot reduce the exposure window between reviews. The Ultimate Guide to NHIs — What are Non-Human Identities is helpful for distinguishing identity types, while the broader Ultimate Guide to NHIs explains why lifecycle control matters more for non-human accounts than for most human-user models. For teams comparing controls, the practical rule is simple: use reviews to validate, use ZSP to prevent, and use both where the environment can support it.

Related resources from NHI Mgmt Group

• What is the difference between zero standing privilege and continuous identity?
• What is the difference between JIT access and Zero Trust for NHIs?
• What is the difference between zero standing privilege and just-in-time access?
• What is the difference between just-in-time access and zero standing privilege?