Zero Standing Permissions
Zero standing permissions (ZSP) is a security model in which no user, agent, or system retains persistent privileged access. Elevated permissions are granted only when needed, scoped to a specific task, and revoked on completion. In the context of AI agents, ZSP means an agent starts every session with no access and receives only what the current task requires.
Why It Matters
The concept was originally coined by Gartner in the context of privileged access management for humans. The principle is straightforward: standing privileges create a persistent attack surface. If an attacker compromises a privileged account, they inherit whatever access that account holds, whether or not anyone was actively using it.
For AI agents, ZSP shifts from a security aspiration to an architectural default. The mechanical friction that makes zero trust impractical for humans (requesting access for every action, waiting for approvals, losing workflow context) is handled programmatically by agents. An agent can request, receive, use, and release scoped permissions within milliseconds.
This makes agents the first identity type where zero standing permissions is not a tradeoff between security and productivity. It is both at once.