Least Privilege is a valuable and irreplaceable principle of cybersecurity. Principles are particularly valuable because of their flexibility across different contexts. However, its efficacy varies greatly depending on context:
- Admin/Machine/Agent Privilege – administrative and system access to operating systems, databases, applications, cloud platforms, identity systems, etc.
- End-user/Business Privilege – access to unstructured data (document libraries, team sites), structured data (tables/rows/columns), and business transactions
- Network Privilege – connectivity between systems (zero trust): which endpoints can communicate with which others, and on what ports
Least privilege has a proven track record reducing risk in #2 and #3. But it has been far less effective for administrative access. The challenge is becoming more urgent as machine identities increasingly outnumber human administrators. Service accounts, cloud workloads, Kubernetes service accounts, automation platforms, and AI agents are all becoming first-class security principals. Whether authenticated by secrets, certificates, tokens, managed identities, or workload identities, these non-human identities frequently accumulate powerful standing privileges.
Why?
For least privilege to materially reduce risk, there must be meaningful variation in the objects and permissions required across roles. Least privilege is not just about the level of access, but also which objects that access applies to. (we’ll return to those to 2 scopes later when we get into 2D vs 3D)
Several factors limit least privilege’s efficacy for administrators:
- Quantity – There are far more end users than administrators, but increasingly there are even more machine identities than either. Modern organizations may have thousands of employees but hundreds of thousands of service accounts, workloads, applications, APIs, and automated agents.
- Heterogeneity – End users represent a wide range of roles and job functions. Administrators, by contrast, are typically segmented by technology (OS, database, cloud, application), but within those domains they often retain full control over all systems they manage.
- Technology limitations – Much of our infrastructure still reflects a decades-old model: a system designed with strong separation for end users, but a monolithic “root” authority at the system level. Attempts to break up that authority are layered on afterward—and are difficult, costly, and often incomplete.
- Practical realities – Administrative work is inherently unpredictable. When something breaks, the privileges required to fix it don’t always align with predefined roles or boundaries.
There are additional reasons least privilege falls short for admin access.
System privilege is vastly more powerful than end-user or network access. A single compromise of administrative access is typically far more damaging than isolated failures in other control layers.
So, after implementing least privilege as best you can for admins, organizations layer on additional protections like MFA, EDR and PAM/PSM as well as tiered environments.
Time is the 3rd Dimension that Zero Standing Privilege Addresses
So even if you’ve done everything right—least privilege, PAM, MFA—why do privileged accounts still show up in so many breaches?
The problem is that least privilege controls how much access exists—but it does not control when that access exists.
In most environments, administrative privilege is still standing privilege—always present, always available, and therefore always exposed. This is the gap that Zero Standing Privilege (ZSP) addresses.
Classic least privilege operates in two dimensions:
- Which systems or objects
- What permissions on those objects
ZSP introduces a third dimension: time
In a ZSP model:
- No user—human or service—has permanent rights
- Privileged access is granted only when needed
- That access is scoped to a specific task and time window
- And it is automatically removed when no longer required
This fundamentally changes the security model.
Instead of defending privileged accounts that always exist, you reduce risk by ensuring that privileged access does not exist until it is needed—and disappears immediately afterward.
The result is not just fewer privileges—but dramatically less exposure time.
In this real training for free event, we will examine:
- Why least privilege consistently falls short for administrative access
- How attackers exploit standing privilege in modern environments
- What Zero Standing Privilege looks like in practice
- How just-in-time access makes ZSP achievable
- The architectural and operational changes required to move in this direction
Beyond traditional administrator accounts, we will also examine:
- Machine identities and workload identities
- Service accounts and cloud-native identities
- DevOps automation identities
- AI agent identities
Zero Standing Privilege is not built into operating systems or cloud platforms—it is an operational model that requires rethinking how privileged access is granted, controlled, and removed.
My sponsor for this real training for free event is Delinea and John Martinez, Technical Evangelist at Delinea, will explore how organizations can operationalize ZSP to provide real-time, just-in-time access across their infrastructure, cloud, and SaaS environments, including DevOps. The discussion will focus on the practical challenges of replacing persistent privileged access while balancing the need for developer productivity and operational continuity with the solutions from Delinea.