Glossary
Privilege Bracketing
Privilege bracketing elevates a process or session to a higher privilege level only immediately around the specific operation that requires it, then drops back to the lower, ordinary privilege level as soon as that operation completes — rather than running with the elevated privilege for an entire session or process lifetime just because one particular operation, somewhere in the middle of it, happens to need it.
This is a finer-grained, lower-level pattern than provisioning time-bound access through an approval workflow: bracketing typically operates within a single process, around a single system call or operation, measured in milliseconds rather than the hours a typical just-in-time access grant might span. Both patterns share the same underlying goal — minimizing how long elevated access exists — applied at very different scales.