The attacker was already inside.
This is what happens when access controls are slow, clumsy, or permanent. Security isn’t just about having the right keys—it’s about who holds them, when, and for how long. That’s where Just-In-Time (JIT) access approval in Kerberos changes the game.
Kerberos is still one of the most trusted protocols for authenticating users and services in enterprise networks. But its default model was designed decades ago—permissions granted for long periods, static access lists, sprawling admin rights that no one remembers to revoke. The result? Massive attack surfaces and dangerous persistence for compromised accounts.
Just-In-Time access approval reshapes this. Instead of granting standing privileges, accounts receive elevated rights for minutes or hours, only after explicit approval. Once the clock runs out, those rights vanish. No lingering admin accounts. No forgotten permissions.
When integrated with Kerberos, JIT approval leverages the protocol’s ticketing system. Kerberos issues time-limited, renewable tickets. With a JIT layer on top, those tickets aren’t just time-bound—they’re approval-bound. An engineer or service account doesn’t just log in; they request elevation. The request is evaluated in real time, backed by policy, and only granted if truly needed. Logging captures every event. Attackers can’t exploit what doesn’t exist.