Can every account really have zero standing privileges?

Rarely on day one. Break-glass accounts, some service accounts and platform owners often keep standing rights at first. The practical approach is to remove standing rights from people first, vault and monitor whatever remains, move workloads to short-lived credentials where the platform allows, and track the number of standing privileged accounts as a measure that should fall over time.

Does zero standing privileges slow engineers down?

It adds a request step, so the request has to be quick. Pre-approved policies for low-risk access, approvals inside chat tools, and requests linked to tickets keep the delay short. Teams usually accept the step when they no longer need to manage personal admin passwords or keys, because the system supplies credentials for each session.

Glossary

Zero standing privileges (ZSP)

Also called ZSP, zero standing access, ZSA, no standing privileges

Zero standing privileges (ZSP) is a security model in which no human or machine identity holds privileged rights by default; elevated access is created for a specific task when requested and approved, then removed when the task or time window ends.

Rudratic glossary

Zero standing privileges means that, at rest, nobody is an administrator. Accounts exist, but the rights that let them change systems or read sensitive data are absent until someone asks for them for a reason, and they disappear again afterwards. It takes least privilege one step further, by adding time: not only the minimum rights, but only for the minimum period.

How it works

ZSP depends on three pieces working together:

No permanent privileged assignments. Administrator group memberships, superuser roles and long-lived cloud keys are removed from day-to-day accounts.
Just-in-time access. When work needs elevated rights, the user requests them; policy and approvers decide; the grant expires.
Credentials the user never holds. A credential vault or proxy supplies the secret to each session, or the platform issues short-lived credentials.

Microsoft’s documentation for Purview privileged access management describes the model plainly: instead of administrators having constant access, organisations apply just-in-time access rules, and with the feature enabled for Exchange Online the organisation “operates with zero standing privileges”.

Why it matters

Standing privileges are what attackers look for after stealing a password or token. If a compromised account holds no rights at rest, the attacker must also get a request approved, which is visible and time-limited. CISA’s Zero Trust Maturity Model moves access management from “permanent access with periodic review” towards access that expires and, at the optimal stage, just-in-time and just-enough access. For workloads, AWS recommends temporary credentials through IAM roles over long-term access keys, and OWASP lists long-lived secrets and overprivileged identities in its Non-Human Identities Top 10.

ZSP vs least privilege vs JIT

Term	What it limits	Question it answers
Least privilege	Scope of rights	How much access is needed?
JIT access	Timing of rights	When is access granted, and for how long?
Zero standing privileges	Default state	What access exists when nobody is working?

Examples

Domain administrator group is empty except for a monitored break-glass account; engineers join it for an approved hour.
Developers have no production cloud role; they request an operator role for a deployment window.
Database users connect through a proxy that creates a temporary account for the session and revokes it on disconnect.

How SWOT supports it

SWOT PAM grants time-bound access that ends on its own and injects credentials at the proxy so they never reach the user’s device; database sessions get a temporary account that is revoked on disconnect. SWOT Cloud PAM replaces long-lived cloud keys with short-lived credentials issued per approved session. See zero standing privileges for the full approach.

Questions

Can every account really have zero standing privileges?: Rarely on day one. Break-glass accounts, some service accounts and platform owners often keep standing rights at first. The practical approach is to remove standing rights from people first, vault and monitor whatever remains, move workloads to short-lived credentials where the platform allows, and track the number of standing privileged accounts as a measure that should fall over time.
Does zero standing privileges slow engineers down?: It adds a request step, so the request has to be quick. Pre-approved policies for low-risk access, approvals inside chat tools, and requests linked to tickets keep the delay short. Teams usually accept the step when they no longer need to manage personal admin passwords or keys, because the system supplies credentials for each session.