Access tied to the rotation, not to any individual permanently
On-call elevation grants temporary, broader access to whoever currently holds an on-call rotation, so they can respond to an incident in a service they don't normally own or operate day to day. The access is tied to the rotation itself rather than to any individual permanently — when the rotation changes hands, the elevated access should move with it, granted to the new on-call engineer and withdrawn from whoever held it before, rather than accumulating with each successive person who's ever taken a turn.
This is a specific, recurring instance of just-in-time access applied to incident response: the task — being ready to respond to whatever comes up during this rotation — genuinely does require broader reach than day-to-day work, and the access should exist only for as long as that specific task, the rotation, actually lasts.
The failure mode is always the same: a sync that didn't happen
The common failure here is treating on-call elevation as a one-time setup rather than a continuously rotating grant: an engineer who was on call once, months ago, and never had that elevated access explicitly revoked afterward, quietly retains standing access to systems they no longer have any operational reason to touch. This is exactly the kind of forgotten grant that time-bound access is meant to prevent, reintroduced specifically through a rotation that wasn't kept properly synchronized with the actual access it was supposed to control.