Glossary
Standing Access
Standing access is granted once and remains valid indefinitely, independent of whether the identity holding it is actively using it right now. It is usually the path of least resistance to set up — provision it once, never think about it again — which is exactly why it accumulates: every task that ever needed a permission tends to keep it long after the task is done.
The risk is not that standing access is ever used maliciously by its original holder; it is that it sits there, available to anyone who later compromises that identity, for as long as nobody notices and removes it. The alternative — access scoped to the lifetime of a task and withdrawn automatically when it ends — costs more to set up and dramatically less to leave in place.