Skip to content
If it doesn't work, you don't pay. 30 days.
Implementa.
← Full glossary

Zero standing privilege (ZSP)

seguridad

ZSP

Zero standing privilege is the principle that no one, neither a person nor an AI agent, keeps privileged access by default: access is granted only when needed, for as long as needed and with justification.

Implementa's formulation. Instead of leaving broad permissions active 'just in case', access is provisioned just in time, with conditions such as a business justification or re-authentication, and withdrawn when the task ends. Applied to agents it reduces the damage if an agent drifts or is compromised, at the cost of more permission orchestration. SailPoint extended it in 2026 to people, service accounts and agents.

How it differs from

Least privilege
Least privilege limits how much access one has; zero standing privilege also limits when one has it.
Just-in-time provisioning
Just-in-time provisioning is the usual mechanism for achieving zero standing privilege.

Examples

  • A support agent gets write access to the ERP for only 30 minutes after an approval in Slack.
  • An administrator requests a privileged role via a ticket and the access expires when the task closes.

FAQ

Is it realistic for agents?
Yes for high-risk actions, but granting and revoking permissions must be fast and automatic or it slows the workflow.
Does it remove the risk?
No. It narrows the exposure window; an agent can still misuse access while it holds it.

Related terms

non-human-identityruntime-authorization

Sources & further reading