Elevating only around what actually needs it
Privilege bracketing elevates a process or session to a higher privilege level only immediately around the specific operation that requires it, then drops back to the ordinary, lower privilege level as soon as that operation completes — rather than running with the elevated privilege for an entire process or session lifetime just because one particular step, somewhere in the middle of a much longer sequence, happens to need it.
The gap this closes is real: a process that acquires elevated privilege at startup and holds it the whole time it runs is vulnerable to that elevated privilege being misused at any point during its entire lifetime, not just during the brief moment it was actually needed. Narrowing the window narrows exactly how long that exposure exists.
A finer-grained relative of just-in-time access
This is a lower-level, finer-grained pattern than provisioning time-bound access through an approval workflow — bracketing typically operates within a single process, around a single operation or system call, measured in milliseconds rather than the hours a typical just-in-time access grant might span. Both patterns share the same underlying goal of minimizing how long elevated access exists at all; they simply apply it at very different scales, and a system built well often uses both together, at the scale each is actually suited to.