Standing privilege

Standing privilege is authority that persists whether or not it is being used: durable admin rights, long-lived API keys, accumulated OAuth scopes. It is what turns a single compromise into lateral movement, because the attacker inherits everything the identity could ever do, not what it was doing. Modern remediations, JIT access, scope narrowing, expiry, all attack the standing part.

The reason this dominates blast radius is that attackers inherit capability rather than intent. A compromised identity can do everything it was ever permitted to do, including the permissions granted for a project that ended, and the attacker has time to enumerate them.

Scope accumulation through OAuth consent is the version that grows quietly, because each individual grant was reasonable at the moment it was requested.

Attackers inherit capability rather than intent, which is the sentence that explains why this dominates blast radius. A compromised identity can do everything it was ever permitted to do, including permissions granted for a project that ended two years ago, and the attacker has time to enumerate them while the legitimate owner is using a fraction.

Scope accumulation through consent flows is the version that grows quietly, because every individual grant was reasonable when it was requested. Nothing in the flow asks whether the union of what has been granted is still reasonable, and nothing removes a scope when the feature that needed it is retired.

Measuring it is more tractable than it sounds, and the measurement is the thing that motivates the work. For each identity, compare the permissions held against the permissions exercised over a representative window; the gap is standing privilege, expressed as a number somebody can be asked to reduce. Closing it is what just-in-time capability tokens and scope expiry are for.

Expressing the gap as a number gives the reduction work an owner and a finish line, which a policy statement does not.

In agentic systems the accumulation happens faster, which is the problem agentic identity exists to manage.