Zero Standing Privileges
Zero standing privileges (ZSP) is an access model in which no human or machine identity holds permanent elevated rights: every privilege is granted just in time for a task, with approval or policy, and expires automatically. It is the end state of removing standing privilege, and the strongest form of least privilege for admin access.
| ZSP means | ZSP does not mean |
|---|---|
| Admin roles are eligible, activated per task and time-boxed | No one can ever be an admin |
| Permanent assignments limited to monitored break-glass accounts | Removing emergency access |
| Machine identities get scoped, short-lived credentials | Only humans are in scope |
Zero standing privilege is the outcome that makes a privileged access program measurable: count the identities holding permanent elevated rights and drive it toward zero. It also changes what a compromised admin workstation means, since there is nothing to inherit at rest. The prerequisite is an elevation path fast enough that engineers use it during an incident rather than keeping a standing account "just in case".
See also: just-in-time access, least privilege, what is PAM, break-glass
Related on Start with Identity
- GlossaryPrivileged Access Workstation (PAW)
A privileged access workstation (PAW) is a dedicated, hardened computer used only for administrative work, with no email, no general web browsing and only appro
- GlossarySession Recording
Session recording is the capture of what happens inside a privileged session (terminal output, commands, screen and mouse activity, database queries) so that it
- GlossaryPrivilege Escalation
Gaining higher access than originally granted, by exploiting misconfigurations, vulnerabilities, or over-permissioned identities. Tightly linked to privileged a
- BlogBeyondTrust Remote Support zero-day let ARMORY CASTLE dump the credential vault
CVE-2026-102764, a CVSS 9.3 flaw in self-hosted BeyondTrust Remote Support through 26.2.3, was exploited as a zero-day by the China-nexus group ARMORY CASTLE. M
- CVEBeyondTrust Remote Support zero-day, from file upload to the whole credential vault
An origin-validation flaw in self-hosted BeyondTrust Remote Support through 26.2.3 let ARMORY CASTLE plant a web shell, export every vaulted admin credential, a
- GuideRolling out zero standing privileges
[Zero standing privileges](/glossary/zero-standing-privileges/) (ZSP) means no human or workload holds permanent elevated access: privileges are granted [just i