Zero Standing Privileges

Permissions are not pre-provisioned. When an agent needs to access a resource, it requests ephemeral credentials that are generated, scoped, and granted at the exact moment of need. These credentials are short-lived, often expiring in seconds or minutes, and are automatically revoked after the task completes. This eliminates the window of opportunity for stolen credentials to be reused.

• Credentials are generated on-demand, not fetched from a vault
• Typical Time-to-Live (TTL): seconds to minutes
• Revocation is automatic and guaranteed by the credential's inherent expiry

Access rights are not only temporary but dynamically scoped to the minimum necessary for the specific request. A policy engine evaluates the agent's identity, the target resource, and the requested action in real-time. This enforces true least privilege, where an agent reading a specific file receives read-only access to only that file, not the entire directory.

• Permissions are bounded by the exact parameters of the request
• Uses Attribute-Based Access Control (ABAC) for fine-grained decisions
• Prevents lateral movement by limiting scope to a single resource

ZSP is reinforced by running the agent's task in a disposable, single-use environment. This ephemeral context is created from an immutable, known-good image and is completely destroyed upon task completion. No state, cached credentials, or malicious artifacts persist between jobs, preventing cross-task contamination and ensuring a clean slate for every operation.

• Environment is provisioned fresh for each discrete task
• No persistent storage of secrets or session tokens
• Eliminates the risk of credential harvesting from a long-running process

Authorization is not a one-time gate at the start of a session. A Policy Enforcement Point (PEP) continuously evaluates the agent's context throughout its execution. If the agent's behavior, network destination, or risk score changes, access can be revoked mid-session. This is a shift from static, session-based auth to a continuous, real-time authorization model.

• Session is constantly evaluated against the security policy
• Anomalous behavior triggers immediate credential revocation
• Integrates with runtime security signals from eBPF probes

A critical safety valve for ZSP is the break-glass procedure. In an emergency, a human operator can bypass the automated JIT system to gain immediate, audited access. This ensures that strict security automation does not prevent incident response. All break-glass events generate high-severity alerts and are logged immutably for forensic analysis.

• Provides a human-in-the-loop override for emergency access
• All break-glass usage is immutably logged and alerted on
• Balances security automation with operational reality

A component in the system architecture that intercepts a request from an agent and enforces an authorization decision before allowing the action to be executed against a protected resource. The PEP is the gatekeeper that physically blocks access until a Just-In-Time Access grant is verified.

• Commonly implemented as a reverse proxy, API gateway, or sidecar
• Queries the Policy Decision Point on every request
• Must fail closed (deny by default) if the policy engine is unreachable

A security principle dictating that an agent or process should be granted only the minimum set of permissions, capabilities, and access rights necessary to perform its designated function. Zero Standing Privileges is the dynamic, temporal enforcement of this principle.

• Applies to both the agent's runtime (e.g., Seccomp Profile) and its API access
• Requires granular scoping: read-only vs. read-write, specific rows vs. entire tables
• Reduces the blast radius of a prompt injection or tool-calling exploit

A short-lived, disposable execution context for an agent that is created from a known-good, immutable image and completely destroyed after a single task or session. This prevents state contamination and ensures no residual credentials survive the agent's lifecycle.

• Often implemented with MicroVM runtimes like Firecracker
• Ensures that even if credentials are leaked, they expire with the environment
• Prevents persistent backdoors from surviving a single execution cycle