Just-in-time access
Just-in-time (JIT) access grants a permission only when it is needed and revokes it automatically when the time or task is up, replacing standing access with access that expires on its own.
Just-in-time access inverts the default. Instead of granting access once and trusting someone to remember to remove it, a JIT grant carries its expiry from the moment it is approved: production access for the length of an incident, admin rights for a migration weekend, a contractor's access until the contract date. When the clock runs out, the revocation happens on its own: no ticket, no memory required.
Why standing access is the alternative worth killing
Every standing grant is attack surface for as long as it exists, whether or not it is used. Compromised credentials are only as dangerous as what they can reach, and estates full of permanent admin rights make every phished account a serious incident. JIT shrinks the window: the same access exists, but only during the minutes it is earning its keep. It is least privilege applied to time rather than scope.
Where it fits
JIT works best where access need is bursty (production systems, admin consoles, sensitive data) and is usually delivered through a request flow: someone asks, policy or an approver says yes, the grant lands with an expiry. In Ploy that is the access requests flow, where a grant's lifetime is part of the request, not an afterthought.