Who should own the shift from least privilege to zero standing access?

Why This Matters for Security Teams

The ownership question is less about org charts and more about whether standing access survives contact with real operations. least privilege is easy to approve in a policy deck, but zero standing access changes how identities are provisioned, how exceptions are approved, and how evidence is collected when something goes wrong. The shift also touches incident response, platform reliability, and auditability, so it cannot sit in IAM alone.

Current guidance from the OWASP Non-Human Identity Top 10 and NIST SP 800-207 Zero Trust Architecture points toward shared responsibility, because access decisions must reflect workload context, not just static role assignment. For NHI programs, that means identity teams define the control plane, security teams define the policy and assurance requirements, and platform teams make those controls usable in pipelines and runtime systems. NHI Management Group’s Ultimate Guide to NHIs shows why this matters: 97% of NHIs carry excessive privileges, which is exactly how “temporary exceptions” become permanent exposure.

In practice, many security teams encounter privilege sprawl only after access is already embedded in deployment scripts, support workflows, or break-glass paths.

How It Works in Practice

Zero standing access usually works best when ownership is split by function but governed by a single operating model. Identity teams should own the entitlement model, approval logic, and lifecycle controls. Security teams should own policy standards, monitoring expectations, and exception thresholds. Platform and infrastructure teams should own the technical enforcement points where JIT access, workload identity, and session logging are actually applied.

That division matters because standing access is rarely removed by policy alone. It is removed when access is issued only at the moment of need, tied to a verified request, and revoked automatically when the task ends. For human operators, that often means PAM and JIT workflows. For machine-to-machine and agentic systems, the more durable pattern is workload identity plus short-lived credentials, as described in the 52 NHI Breaches Analysis and the OWASP NHI guidance. The control objective is the same: prove who or what is acting, limit duration, and preserve traceability.

• Identity defines who can request access and under what conditions.
• Security defines what approvals, logs, and reviews are mandatory.
• Platform teams wire the controls into CI/CD, cloud, and runtime systems.
• Audit and IR teams validate that revocation is real, not symbolic.

There is no universal standard for this yet, but best practice is evolving toward policy-as-code, just-in-time elevation, and evidence capture at the point of access. NHI Management Group’s Ultimate Guide to NHIs — Key Challenges and Risks also highlights why this is necessary: most organisations still have excessive privileges and poor visibility, which makes ownership clarity a control requirement rather than a governance preference. These controls tend to break down when approval workflows are disconnected from the systems that actually grant the permission, because exceptions then become the default path.

Common Variations and Edge Cases

Tighter zero standing access often increases operational friction, so organisations must balance faster recovery and smaller blast radius against the need for rapid support and delivery. That tradeoff is real, especially in regulated environments and 24/7 infrastructure.

The common exception is break-glass access. Current guidance suggests break-glass should not be treated as standing access with a new label. It needs explicit ownership, strong monitoring, and post-use review. Another edge case is legacy infrastructure where JIT cannot be enforced cleanly. In those environments, the safer short-term answer is not to assign ownership to a single team, but to create a joint control board with clear RACI, because invisible gaps between IAM, PAM, and platform teams are where standing access reappears.

For agentic systems, the ownership model becomes even more important. Autonomous workloads do not behave like human users, so static roles and pre-approved access packages often fail once an agent chains tools or changes goals mid-run. That is why OWASP Non-Human Identity Top 10 and NIST SP 800-207 Zero Trust Architecture both support runtime decisions over static entitlement sprawl.

Related resources from NHI Mgmt Group

• When is zero standing privilege more useful than broader access models?
• What is the difference between least privilege and zero standing privilege for NHI governance?
• What is the difference between zero standing privilege and just-in-time access?
• What is the difference between just-in-time access and zero standing privilege?