The Standing Access Problem

Most privileged access is permanent. Someone was granted administrative rights for a reason that applied once, and the grant never expired.

Why permanence is the problem

A compromised credential is useful indefinitely. There is no window to miss.

The attack surface is the sum of all grants, all the time, rather than the small subset actually in use at any moment.

Nobody reviews it. Standing grants accumulate silently and are never removed by any routine process.

It defeats detection. Administrative activity from a permanently privileged account looks normal, because it is normal.

It removes the decision point. With just-in-time access there is a moment where someone asks why; with standing access there is no moment.

How it accumulates

Granted for a project that ended.

Granted to resolve an incident at two in the morning and never revoked.

Inherited through group nesting that nobody has traced.

Copied from a colleague's account during onboarding, which propagates the most privileged template in the team.

Granted because the approval process was slower than the deadline.

Retained through role changes, which is the mover problem applied to administrative rights.

Zero standing privilege

The target state, stated plainly: no account holds administrative rights except during an approved, time-bounded task.

Rights are granted on request, for a duration, with a reason recorded.

They expire automatically.

The grant itself is the audit record.

Fully achieving this is rare. Partially achieving it — on tier zero, or on the most sensitive systems — is achievable and delivers most of the benefit.

What has to exist first

A request path faster than the workaround. If elevation takes an hour of approvals, administrators will keep a standing account, and they will be right to.

Automatic expiry that actually works, including when the system that grants is unavailable.

A break-glass route for when the granting system is down, designed and tested rather than improvised.

Approval that is proportionate. Requiring a manager's signature for routine work produces either delay or rubber-stamping, and rubber-stamping is worse because it looks like control.

The intermediate steps

Full elimination is a long programme. These deliver value earlier.

Remove standing tier zero access first. Smallest population, largest consequence.

Separate administrative accounts from daily-use accounts, so that a phishing email to someone's ordinary mailbox does not land in a privileged session.

Time-bound the grants you cannot remove, with a quarterly re-approval rather than permanence.

Remove local administrator rights from workstations, which is a large reduction in exposure and the change users notice most.

Reduce membership before you reduce duration. Fewer people with standing access is simpler than temporary access for the same number.

Measuring it

Count of accounts with standing administrative rights, by tier, tracked monthly.

Proportion of privileged sessions obtained just-in-time versus using standing rights.

Median duration of a granted elevation.

Grants that expired unused, which indicates over-requesting rather than a problem.

The first number is the programme's headline metric, and it should fall. If it is not falling, the deployment has added a vault and changed nothing else.

The parallel run

Removing standing rights without a parallel period produces an outage and a rollback.

Make just-in-time available while standing rights remain.

Run for a month, at minimum.

Measure which path is used. If administrators keep using standing rights, the new path is too slow, and that is fixable information rather than a discipline problem.

Find what breaks: scheduled tasks running as an administrator, automation assuming permanence, long sessions outliving a grant.

Fix those, then remove standing rights by cohort, smallest first, with a documented rollback.

The parallel run is the whole reason the removal succeeds, and skipping it is the most common cause of a reversed deployment.

Where standing access remains legitimate

Full elimination is rare and pretending otherwise produces undocumented exceptions.

Break-glass accounts, by design.

Some service accounts, until they migrate to managed or dynamic identities.

Systems that cannot support dynamic grants, which includes many appliances.

Certain operational roles where elevation on every action would be unworkable.

For each, record it: what, why, what compensating controls apply, and when it will be revisited.

Report the count and the trend. A shrinking list of documented exceptions is a healthy programme; an unmeasured population of standing rights is not.