Rolling out zero standing privileges

What zero standing privileges means

Zero standing privileges (ZSP) is the strongest form of least privilege: no human holds permanent elevated access. Instead, privileges are granted just in time, scoped to a task, and expire automatically. The payoff is direct: if no one carries standing admin rights, a compromised account or stolen session has far less to abuse, and lateral movement and privilege escalation get much harder.

Why it matters now

Most breaches escalate through over-permissioned accounts and dormant admin rights. Standing privilege is the fuel. Cloud made it worse: identities accumulate entitlements across AWS, Azure, and GCP that nobody uses but attackers can. ZSP, delivered through just-in-time access, removes that standing attack surface.

The rollout sequence

1. Discover privileged access. Inventory who and what holds elevated rights across cloud, SaaS, on-prem, and non-human identities. Tools in CIEM and PAM surface effective permissions.
2. Right-size first. Remove unused and excessive entitlements before automating. You cannot grant just in time if the baseline is already bloated.
3. Introduce just-in-time access. Route elevation through an approval and time-box workflow, starting with the highest-value targets (cloud admin, production, domain admin).
4. Automate grant and revoke. Access is requested, approved (or auto-approved by policy), granted for a fixed window, and revoked automatically. Self-service with guardrails keeps it usable.
5. Add break-glass. A tightly controlled break-glass account for emergencies, with strong vaulting, alerting, and regular testing.
6. Measure standing privilege down to near zero. Track the count of accounts with permanent elevated rights and drive it toward zero over successive quarters.

Make it usable, or it fails

ZSP dies if elevation is slow or annoying; people route around it. Invest in fast approvals (chat-based, policy-driven auto-approval for low-risk requests), clear audit, and good defaults. The aim is that getting access just in time is easier than hoarding it.

Common pitfalls

• Automating JIT on top of an un-right-sized, over-permissioned baseline.
• Forgetting non-human identities and service accounts, which often hold the broadest standing rights.
• A break-glass account that is never tested and fails during a real incident.
• Friction so high that users demand standing exceptions, recreating the problem.

Related

Guide: what is PAM, how to choose a PAM solution. Vendors: PAM, CIEM. Glossary: zero standing privileges, least privilege.