They gave the intern more access than the CEO.

This is the paradox of bad permissions. In too many systems, Consumer Rights Zero Standing Privilege is a forgotten principle. It says no user should hold access by default. Rights are earned when needed, and gone when the need ends. But in most stacks, access lingers. Tokens never expire. Roles pile up like debris. This is how breaches happen. This is how teams lose control.

Zero Standing Privilege (ZSP) is not new. It comes from a hard truth: standing privileges are permanent attack surfaces. Remove them, and you shrink the blast radius. Keep them, and you invite trouble. The “consumer rights” twist applies the same discipline to everyone — human users, service accounts, contractors, even automated tasks. Nobody gets more than they need, no matter their role.

To make ZSP real, you need systems that grant on-demand access. Time-based rights. Just-in-time elevation. Ephemeral credentials that expire without manual cleanup. You must log every grant and every revoke. The logs must be immutable and visible, so any rights that stay too long become obvious.

The hardest part is not the tech. It’s breaking habits. People like keeping access “just in case.” Managers fear the friction. But friction is cheaper than forensics after a leak. A clean, fast workflow for access requests solves this. Automation solves the rest.

The best ZSP designs are invisible in daily work. Access in seconds, clean removal in moments, no shadow credentials. This is security that doesn’t slow the team. This is how you align consumer rights with strict privilege hygiene — by removing the permanent privileges that put systems at risk.

You don’t secure a platform by trusting people forever. You secure it by trusting processes every time. The companies leading here are the ones where nobody asks “Who still has access?” because the answer is always “Nobody, unless they need it right now.”

See how this works in practice. Spin up a real Zero Standing Privilege flow with hoop.dev in minutes and watch a secure, on-demand permission system work live.