Agent Governance Register

Reviewed

Standing privilege

In short: Standing privilege is access that stays granted whether or not it is being used. A static API key with broad scopes is the classic example. Standing privilege gives attackers a long window and is the main thing that just-in-time access and decommissioning are designed to remove.

Which controls use this term?

  • GOV-05Short-lived credentials. Issue agents credentials that expire within minutes or hours and are scoped to a task, instead of static keys or long-lived tokens.
  • GOV-12Decommission at task end. Remove an agent's identity, credentials and access as soon as its task or project ends, and record when that happened.

Which terms are related?

Non-human identity, Just-in-time access, Short-lived credential, Decommissioning.

Reviewed by The Register desk