Zero Standing Permissions
Zero standing permissions (ZSP) is a security model in which no user, agent or system holds persistent privileged access. Access is authorized independently each time it is used rather than granted once and carried forward. In the context of AI agents, ZSP means the agent holds no credential and no lasting permission of its own. Every tool call is checked against policy before it runs.
Why It Matters
The concept comes from privileged access management for humans. The principle is straightforward: standing privileges create a persistent attack surface. If an attacker compromises a privileged account, they inherit whatever access that account holds, whether or not anyone was actively using it.
For AI agents, ZSP shifts from a security aspiration to an architectural default. The mechanical friction that makes zero trust impractical for humans (requesting access for every action, waiting for approvals, losing workflow context) is handled programmatically by agents. Because an agent can ask for access and use it within milliseconds, authorizing every single call costs nothing in workflow time.
ZSP does not describe anything being cleaned up at the end. Nothing is handed back when a task finishes, because nothing was handed over in the first place. The credential stays in Cakewalk's vault only while the access is held, scoped to one Connection. Revoking a person's access deletes that credential, so agents acting for them cannot start a new session or reconnect. A session already running is not re-checked call by call, and it continues until its gateway token expires, which can be up to eight hours.
This makes agents the first identity type where zero standing permissions is not a tradeoff between security and productivity. It is both at once.