When does just-in-time access reduce risk less than expected?

Why This Matters for Security Teams

Just-in-time access only reduces risk when it is the last layer on top of a disciplined identity lifecycle. If an attacker can still use a static API key, a shared service account, or a long-lived certificate, JIT becomes a temporary gate on top of a weak foundation. That is why NHI governance has to cover both privilege duration and the secret itself, as described in the Ultimate Guide to NHIs and the Ultimate Guide to NHIs — Key Challenges and Risks.

NHIMG research shows the scale of the problem: 91.6% of secrets remain valid five days after notification, which means revocation is often slower than exploitation. That matters because temporary elevation does not compensate for a credential that is still valid elsewhere or reused across pipelines. Current guidance from OWASP Non-Human Identity Top 10 and the NIST Cybersecurity Framework 2.0 both point toward reducing standing access, but neither can rescue an environment where secrets are embedded in code or shared by multiple systems.

In practice, many security teams discover JIT failed only after the static credential was already reused by an attacker, rather than through intentional testing.

How It Works in Practice

Effective JIT for NHI control is a three-part pattern: verify workload identity, issue a short-lived secret or token for a single task, and revoke it automatically when the task completes. That is different from simply granting a privileged role for a limited time. The first approach narrows both the access window and the blast radius; the second often leaves the underlying credential valid long after the session ends. This distinction is central in Guide to NHI Rotation Challenges and in the broader operational guidance of the Ultimate Guide to NHIs.

For autonomous systems and agents, the control plane should prefer workload identity and intent-based authorization over static role assignment. In practice, that means cryptographic proof of what the agent is, plus policy evaluation at request time based on what the agent is trying to do. Mature designs use ephemeral credentials, short TTLs, and revocation hooks tied to workflow completion. Where possible, pair this with zero standing privilege so the agent receives access only for the approved action, not a reusable entitlement. The OWASP Non-Human Identity Top 10 and NIST Cybersecurity Framework 2.0 both support the same operational direction: reduce standing access, monitor usage, and make revocation reliable.

• Issue credentials per task, not per environment, and bind them to a specific workload identity.
• Use short TTLs for secrets, tokens, and certificates, then revoke on completion or abort.
• Evaluate authorisation at runtime so policy can reflect current context, not yesterday’s role.
• Continuously check for secret reuse across code, CI/CD, and shared vaults.

These controls tend to break down when an environment still depends on hardcoded secrets in CI/CD pipelines because the elevation layer cannot compensate for broad credential reuse.

Common Variations and Edge Cases

Tighter JIT often increases operational overhead, requiring organisations to balance faster developer workflows against stronger revocation discipline. There is no universal standard for this yet, especially for agentic systems that change behaviour based on prompts, tool output, and execution context. In those cases, current guidance suggests treating authorisation as a runtime decision, not a static property of the account. That is why the question is not only whether access is temporary, but whether the secret behind it is also ephemeral. The 52 NHI Breaches Analysis is useful for seeing how often identity misuse becomes an incident when controls are layered poorly.

Some environments do not lend themselves to pure JIT. Batch jobs, legacy integrations, and vendor-managed workloads may need longer-lived access, but that should be treated as an exception with compensating controls such as tighter scope, stronger monitoring, and mandatory rotation. This is especially important where shared service accounts or long-lived certificates still exist. The practical lesson from NHIMG research is straightforward: if the secret remains static, JIT only reduces exposure at the margin. For governance teams, the best next step is to align rotation, offboarding, and privileged access reviews so that the temporary session is backed by a credential lifecycle that actually ends. In many real incidents, the gap appears because the organisation assumed JIT had solved the problem while the underlying secret was still usable.

Related resources from NHI Mgmt Group

• How should security teams reduce the risk of rogue developers with privileged access?
• When does ephemeral access reduce MCP risk, and when does it fall short?
• When does just-in-time access reduce risk for agentic AI, and when does it fall short?
• How should teams reduce the risk from exposed NHI secrets?