Standing privilege is the constant, always-on access a user or system has to sensitive environments. It is the default in too many organizations, and it is the default attackers exploit. Phi Zero Standing Privilege is the state where no one — not admins, not engineers, not service accounts — holds permanent access to critical systems. Access is granted only when needed, for the shortest possible time, and then removed automatically.
This principle cuts the attack surface to the bone. No idle credentials drift in darkness waiting to be stolen. No forgotten accounts lurk in old configs. Every access event has context. Every privilege has an expiration.
Implementing Phi Zero Standing Privilege starts with a clean inventory of all access points. Identify every path into production, staging, critical data stores, and CI/CD pipelines. Remove persistent keys. Replace static passwords with short-lived tokens or ephemeral credentials. Automate the provisioning and revocation process using tooling that integrates deeply with identity systems and runtime environments.