# Rolling out zero standing privileges

Source: https://startwithidentity.com/guides/implementation/zero-standing-privileges-rollout/
Last updated: 2026-06-17
License: content by Start with Identity. Cite the source URL.

---

## What zero standing privileges means

[Zero standing privileges](https://startwithidentity.com/glossary/zero-standing-privileges/) (ZSP) is the strongest form of [least privilege](https://startwithidentity.com/glossary/least-privilege/): no human holds permanent elevated access. Instead, privileges are granted just in time, scoped to a task, and expire automatically. The payoff is direct: if no one carries standing admin rights, a compromised account or stolen [session](https://startwithidentity.com/glossary/session-hijacking/) has far less to abuse, and lateral movement and [privilege escalation](https://startwithidentity.com/glossary/privilege-escalation/) get much harder.

## Why it matters now

Most breaches escalate through over-permissioned accounts and dormant admin rights. Standing privilege is the fuel. Cloud made it worse: identities accumulate entitlements across AWS, Azure, and GCP that nobody uses but attackers can. ZSP, delivered through just-in-time access, removes that standing attack surface.

## The rollout sequence

1. **Discover privileged access.** Inventory who and what holds elevated rights across cloud, SaaS, on-prem, and [non-human identities](https://startwithidentity.com/guides/fundamentals/what-is-non-human-identity/). Tools in [CIEM](https://startwithidentity.com/vendors/ciem/) and [PAM](https://startwithidentity.com/vendors/pam/) surface effective permissions.
2. **Right-size first.** Remove unused and excessive entitlements before automating. You cannot grant just in time if the baseline is already bloated.
3. **Introduce just-in-time access.** Route elevation through an approval and time-box workflow, starting with the highest-value targets (cloud admin, production, domain admin).
4. **Automate grant and revoke.** Access is requested, approved (or auto-approved by policy), granted for a fixed window, and revoked automatically. Self-service with guardrails keeps it usable.
5. **Add break-glass.** A tightly controlled [break-glass account](https://startwithidentity.com/glossary/break-glass/) for emergencies, with strong vaulting, alerting, and regular testing.
6. **Measure standing privilege down to near zero.** Track the count of accounts with permanent elevated rights and drive it toward zero over successive quarters.

## Make it usable, or it fails

ZSP dies if elevation is slow or annoying; people route around it. Invest in fast approvals (chat-based, policy-driven auto-approval for low-risk requests), clear audit, and good defaults. The aim is that getting access just in time is easier than hoarding it.

## Common pitfalls

- Automating JIT on top of an un-right-sized, over-permissioned baseline.
- Forgetting non-human identities and service accounts, which often hold the broadest standing rights.
- A break-glass account that is never tested and fails during a real incident.
- Friction so high that users demand standing exceptions, recreating the problem.

## Related

Guide: [what is PAM](https://startwithidentity.com/guides/fundamentals/what-is-pam/), [how to choose a PAM solution](https://startwithidentity.com/guides/buyer-guides/how-to-choose-a-pam-solution/). Vendors: [PAM](https://startwithidentity.com/vendors/pam/), [CIEM](https://startwithidentity.com/vendors/ciem/). Glossary: [zero standing privileges](https://startwithidentity.com/glossary/zero-standing-privileges/), [least privilege](https://startwithidentity.com/glossary/least-privilege/).