Zero Standing Rights: The Architectural Goal of Modern Access Control

If you ask a security architect, "What is the perfect state of access control?", they might say "Least Privilege."

But "Least Privilege" is hard to define. Does a developer need admin access? Maybe for 10 minutes a day, but not for the other 23 hours and 50 minutes.

The true north star of modern identity security is more specific: **Zero Standing Rights (ZSR)**.

What is Zero Standing Rights?

ZSR is the concept that **no user (human or machine) should have permanent privileges.**

By default, everyone has zero access. When they need to do a task, they request access. It is granted instantly (if policy allows), monitored closely, and—most importantly—**revoked immediately** when the task is done.

The Problem with "Standing" Access

Standing access is the root of most breaches.

**Lateral Movement:** Attackers hunt for accounts with standing admin rights.

**Insider Threat:** A disgruntled employee uses their standing access to steal data before they quit.

**Accidental Damage:** A tired engineer runs a `drop database` command on Prod instead of Dev because their account had standing write access to both.

If you have Zero Standing Rights, an attacker who compromises an account gets... nothing. They get an empty shell. To do anything, they would have to request access, which triggers logs, approvals, and visibility.

Implementing ZSR: The JIT Revolution

The mechanism to achieve ZSR is **Just-in-Time (JIT) Access**.

**Ephemeral Permissions:** Instead of adding a user to the "Admin" group permanently, you give them a temporary certificate or token that grants Admin rights for 1 hour.

**Self-Service Workflows:** Developers shouldn't have to wait for IT tickets. They can use a CLI tool or a Slack bot: "Requesting access to Prod DB for 30 mins to debug incident #123." If the policy matches, access is auto-granted.

The Cydenti Approach to ZSR

Moving to ZSR is a journey. You can't just revoke everyone's access tomorrow.

**Discover:** Identify the high-risk standing privileges (the "low hanging fruit").

**Convert:** Start converting your most critical roles (e.g., Cloud Admins) to JIT models.

**Automate:** Use Cydenti to manage the lifecycle of these ephemeral permissions. We ensure that when the timer runs out, the access is truly gone.

Conclusion

Permissions should be like a hotel key card, not a house key. They should work for your stay, and then become a useless piece of plastic.

Zero Standing Rights is an ambitious goal, but it is the only architecture that fundamentally breaks the attacker's playbook. By removing the standing privileges, you remove the target.