Provisioning that matches the task's actual lifetime
Just-in-time access reverses the usual pattern: instead of granting a permission that persists until someone remembers to remove it, access is requested for a specific task, granted for a bounded window tied to that task, and withdrawn automatically once the window closes. The permission exists for exactly as long as it's needed and no longer — which removes, by construction, the long tail of forgotten grants that standing access accumulates.
This requires more supporting infrastructure than granting access once and leaving it — a request-and-approval flow that doesn't create its own bottleneck, and an expiry mechanism reliable enough that access actually ends when it's supposed to, not just in principle.
Where the extra investment pays off
The payoff is concentrated in exactly the accounts worth the most to an attacker: administrative access, break-glass credentials, anything with broad reach. Applying time-bound access there — even if the rest of a system still relies on longer-lived permissions — closes the highest-value gap first, at a fraction of the effort of applying the pattern everywhere at once.