Just-in-Time (JIT) access

Just-in-Time access grants elevated privileges only when a task needs them, and revokes them when the task ends or a timer expires. Instead of holding a permanently privileged account, an administrator requests elevation, an approval or policy check runs, rights are granted for a bounded window, and the session is often recorded. The result is that at any given moment almost no account in the estate holds standing administrative privilege.

Standing privilege is the point. Dormant admin rights are what attackers harvest through credential theft: an account that is privileged for twenty minutes a week presents a far smaller window than one privileged around the clock. JIT is usually delivered through privileged access management tooling and extends least privilege into the time dimension: not just the fewest rights, but the fewest rights for the shortest time. It is also a core mechanic of zero trust, where no session inherits trust from a previous one and every elevation is evaluated on its own merits.

Exam relevance: if a scenario mentions eliminating standing privileges, time-bound elevation, or admin rights granted per task and then removed, the answer is Just-in-Time access. The nearest confusable is plain least privilege, which limits what an account can do but says nothing about when; JIT adds the temporal limit. Mentions of a PAM vault, check-out workflows, or session approval also point to JIT.