Privilege creep

Privilege creep (also called access creep or permission sprawl) is what happens to any identity given enough time: every project, incident, role change, and "can you just give me access to…" adds entitlements, and almost nothing removes them. Each individual grant was reasonable when made. The accumulation is the problem: long-tenured employees end up able to reach systems from three roles ago.

Why it matters

An identity's blast radius is the sum of everything it can reach, not everything it uses. Creep silently grows that radius, so a phished ten-year employee is a far worse incident than a phished new starter, and neither the employee nor anyone else can list what the difference is. It is also how segregation-of-duties violations form: nobody grants a toxic combination on purpose; two halves arrive years apart.

Reversing it

Creep is a rate problem, so the countermeasures are rate-shaped: expiring grants (just-in-time access) stop the accumulation at source, mover events that re-decide access rather than adding to it fix the biggest single cause, and reviews prompted by "granted long ago, unused for months" catch what remains. Ploy surfaces exactly that unused-grant population on the posture page.