What are zero standing privileges? (ZSP for cloud teams)

Zero standing privileges, often shortened to ZSP, means nobody holds permanent access to anything. Instead of standing accounts and always-on permissions, access is granted only when a task needs it and expires afterward. At rest, there’s no privileged access sitting around to be stolen or misused. It’s the endpoint that just-in-time access is working toward.

What “standing” privilege means

Standing privilege is access that’s always on. A developer with permanent admin, a service account with keys that never rotate, a role five people can assume any time: all standing. It’s convenient, and it’s the thing attackers and mistakes both rely on, because it’s there whether or not anyone is using it.

Most cloud accounts are full of it. Palo Alto Networks’ Unit 42 has reported that around 99% of cloud identities are over-permissioned, and a large share of that is standing access nobody has touched in months. Every one of those is a door left unlocked on the chance someone needs it later.

How do you get to zero standing privileges?

Mainly through just-in-time access. Access is requested when a task needs it, approved, and issued as short-lived credentials that expire on their own. As standing grants get replaced by temporary ones, the amount of always-on privileged access in your account trends toward zero.

You don’t flip a switch and reach zero. You chip away at it, moving the riskiest standing access to on-request first, and the number falls as you go.

Zero standing privileges vs least privilege

Least privilege is about how much access an identity has; zero standing privileges is about how long it holds it. Least privilege gives an identity only what it needs to do its job. Zero standing privileges is about the duration: ideally none, until a task requires it.

They work together, but they’re not the same. You can follow least privilege perfectly and still leave a tightly-scoped key sitting around forever, which is standing access ZSP would remove. One shrinks the size of each grant, the other shrinks how long grants exist at all.

Is ZSP realistic for a small team?

The label is enterprise, the idea is not. A small team won’t reach a formally audited zero, and it doesn’t need to. What it needs is fewer standing keys to production, because that’s the access nobody remembers leaving open until it gets abused.

There’s an honest limit. Zero standing privileges controls how much access exists and for how long. It does nothing about what a legitimate session does with the access it does have, and the person who deletes production almost always had legitimate access at that moment. Removing standing access shrinks the problem. It doesn’t close it, which is why who should have production access and what happens during a session both still matter.

Where Korvalis fits

Korvalis works both sides. It hands out access that expires on its own, which pushes you toward zero standing privileges without a heavy platform, and it watches live sessions and cuts off a destructive one before the command finishes, whether the session belongs to an engineer, a stolen key, a contractor, or an AI agent. It installs inside your own cloud account, with no proxy for your engineers to route around.

Frequently asked questions

What are zero standing privileges? Nobody holds permanent access. Access is granted per task and expires, so at rest there’s no privileged access to steal or misuse.

How is ZSP different from least privilege? Least privilege is how much access an identity has. Zero standing privileges is how long it has it. You can do least privilege and still leave standing access in place.

How do you get there? Mostly through just-in-time access: request per task, approve, and issue short-lived credentials that expire on their own.

If moving toward zero standing access sounds right, see how Korvalis does it or join the waitlist.