Insights / ZSP vs. Traditional PAM
Decide and Enforce · Updated 2026
Zero Standing Privilege vs. Traditional PAM: What's the Difference?
Vaulting a credential and granting it broadly is not the same as never letting standing access exist in the first place. The two models sound similar on a slide. They are not the same architecture.
Same Vocabulary, Different Architecture
Traditional PAM's core job is credential custody: store privileged passwords and SSH keys in a vault, rotate them on a schedule, require checkout before use, and record the session. It is a real improvement over credentials living in a spreadsheet — but the access it grants, once checked out, is typically broad and standing for the duration of the session.
Zero standing privilege inverts the default. No credential is usable until a request is evaluated in context and scoped to exactly what's needed, for exactly as long as it's needed. When the task ends, access ends — automatically, not on a rotation schedule.
Where the Two Models Actually Diverge
| Dimension | Traditional PAM | Zero Standing Privilege |
|---|---|---|
| Default state | Credential exists, vaulted | Access does not exist until granted |
| Scope | Broad, tied to the account | Scoped to the specific request |
| Duration | Session-length, manually revoked | Time-bound, auto-expires |
| Decision point | At checkout | At the moment of action |
Knowing the architectural difference is the easy part. Most of the friction shows up during rollout — see our breakdown of the common challenges teams hit adopting zero standing privilege and how to work through them.
The question to ask any vendor
"Once access is granted, what can this credential do, and for how long?" If the honest answer is "broad access for the session," it's vaulting. If it's "exactly this action, for exactly this window," it's zero standing privilege.
Related Reading