Access, and why it never goes away on its own

Concepts and problems

• What access creep is, and how to stop it Why "make my permissions like this other person's" is the ticket that never stops arriving, and what has to change for it to stop.
• What just-in-time access is Granting access on demand is the easy half. Why revocation is the half that decides whether any of it worked, and when the whole idea is wrong.
• What zero standing privilege is How it differs from least privilege — they constrain different axes — what it requires, and the three places it deliberately does not apply.
• Giving a contractor access that expires The one case where the end date is known in advance, and still the case where access outlives the engagement.
• Break-glass access, without leaving the glass broken The two emergencies that share one name, and why the expiry is the part of emergency access that decides whether it was safe.
• Break-glass vs. standing admin vs. a shared root password The four things a team does at 2am when nobody approves, and what each one leaves behind the next morning.
• Least privilege for AI agents that run as you Coding agents have no identity of their own to scope. Why the developer's standing access is the lever, and the token that outlives the membership.
• Should developers have access to production? Yes, for a window. The latency budget a request path has to meet before anyone gives up standing access, and who should approve what.
• How to run a user access review with a small team The steps, a template, the verify step most teams skip, and how to make the next review smaller instead of faster.
• Privileged access management for small business Not the enterprise suite shrunk. Five steps in the order that removes the most risk, and what to leave until a requirement arrives.