Privileged access management solved the problem it was designed for. Credentials that once lived in spreadsheets and script headers now live in vaults — checked out, rotated, recorded. What vaulting did not change is the shape of the privilege itself. The accounts in the vault still hold their power permanently. The vault protects standing privilege; it does not eliminate it. Zero standing privilege is the next commitment: no permanent rights at all, for anyone or anything — privilege that exists only while authorized work is being done.
What vault-and-rotate actually secured
The vault-and-rotate model addresses credential theft. A rotated password is harder to steal and stale sooner if stolen; a brokered session is recorded; a checkout leaves a log entry. These are real gains, and nothing here argues for undoing them. But examine what remains after the model is fully deployed: a population of accounts — domain admins, Exchange admins, service accounts, break-glass identities — each of which is fully powerful twenty-four hours a day, whether or not anyone is doing work. The vault changed where the keys are kept. It did not change the fact that the keys open everything, always.
This distinction — standing power versus stolen credentials — is the one the model cannot see past. An attacker who compromises a vaulted account during a legitimate checkout window inherits everything that account can ever do, not merely what the operator intended to do that hour. An insider with checkout rights holds latent, continuous capability that no rotation schedule diminishes. And every certification campaign confirms the same uncomfortable inventory: hundreds of identities whose permanent power exists to serve work that occupies a fraction of the hours the power exists.
Rotation shortens the life of a credential. It does nothing to shorten the life of the privilege the credential unlocks.
The zero standing privilege model
Zero standing privilege inverts the default: the steady state of every identity, human or machine, is unprivileged. Power is manufactured at the moment of authorized need and destroyed at the moment of completion. In operational terms the model rests on three mechanisms:
- Just-in-time elevation. Rights are granted against a specific, authorized task — not a shift, not a role, not a standing membership. The grant derives its scope from what the task requires and nothing more, and it expires whether or not anyone remembers to revoke it.
- Short-lived execution envelopes. The privileged operation runs inside a bounded envelope: a defined set of actions, target objects, systems, and a time window, bound before execution begins. Work outside the envelope does not fail politely — it is impossible, because no credential exists for it. The envelope is the practical form of the execution contract described in The Identity Execution Gap.
- Trust-scored workers. The entities performing the work — automation workers and, where humans remain in the loop, operators — carry a continuously evaluated trust score built from verification history, anomaly signals, and posture. Elevation decisions weigh the score: a worker with a clean verification record executes routine contracts directly; a degraded score forces additional approval or denies elevation outright. Trust is earned per execution, not conferred per role.
The security consequence is arithmetic. In the standing model, the window of exposure for a privileged identity is all the time. In the ZSP model, it is the sum of active envelope durations — typically minutes per day — and even within a window, the blast radius is the envelope's scope, not the account's historical accumulation of rights.
Evidence as a by-product of work
A less-advertised property of the model is what it does for audit. In the standing world, proving that privileged access was appropriate is an after-the-fact investigation: correlate the checkout log, the session recording, the change record, and hope they agree. In the ZSP world, every unit of privileged work begins with a machine-readable statement of authorization and scope, executes through logged protocol calls, and ends with a verification that the resulting state matches the intent. The evidence is not gathered afterward; it is generated as the work happens, sealed per envelope. Recertification stops being archaeology: the question "who had privileged access to what, and why" has a complete answer for every window in which privilege existed — because privilege only ever existed inside evidenced windows.
Keep the vault, change the execution
The common objection is investment: enterprises have spent years and eight figures deploying PAM, and ZSP can sound like a proposal to rip it out. It is the opposite. The vault becomes more valuable in a ZSP architecture — it is the natural issuer and custodian of the short-lived credentials that envelopes consume, and its session recording remains the right control for the interactive access that survives. What changes is not the custody layer but the execution layer above it. A practical migration sequence for a PAM-heavy enterprise:
| Phase | What changes | What the vault does |
|---|---|---|
| 1. Inventory standing power | Map every privileged account to the operations that actually justify it; measure hours-of-power held versus hours worked | Source of truth for the privileged population |
| 2. Contract the routine | Convert the highest-volume privileged operations — resets, group changes, mailbox delegation, access grants — into bounded execution contracts | Issues just-in-time credentials scoped per contract |
| 3. Retire standing rights | Strip permanent privileges from accounts whose workload now runs through envelopes; convert them to zero-privilege identities that request elevation | Vaults break-glass and residual interactive access |
| 4. Score and tighten | Introduce trust scoring on workers; ratchet approval requirements down for proven contracts, up for anomalies | Custody plus telemetry feeding the trust model |
Sequenced this way, the program shows risk reduction from phase two onward — standing power measurably declines each quarter — without a single day of coexistence risk from replacing custody infrastructure that already works.
What to measure
ZSP progress is unusually quantifiable. Track the count of accounts holding standing privilege (target: approaching zero outside break-glass), aggregate standing-privilege hours per month (the honest exposure metric), median envelope duration, the percentage of privileged operations executed under contract versus interactively, and verification pass rate on completed envelopes. Boards respond to the first two: "we reduced permanently privileged identities from 400 to 30" is a risk statement that requires no translation.
CAELION's Cube23 is the execution layer this model requires: privileged identity operations across AD, Entra ID, Exchange, and PAM run as protocol-bound, just-in-time execution contracts by trust-scored workers, with evidence sealed as the work happens — adjacent to the vault you already own, not in place of it. To scope a keep-the-vault migration against your own privileged inventory, request a briefing.