5.3. Privileged Access with PIM

💡 First Principle: Standing privilege is standing risk: an admin role held 24/7 is exploitable 24/7, but needed perhaps an hour a week. Privileged Identity Management makes privilege temporal — assignments become eligible (a right to activate) rather than active (live power), and activation is gated, bounded, and logged. The blast radius of a compromised admin account collapses to its activation windows.

Fire-alarm glass is the model: the capability hangs on the wall for authorized people, but using it means breaking the glass — a deliberate act (MFA, justification, maybe approval) that everyone can see and audit. PIM is a P2 feature and the reference answer to any stem containing "just-in-time," "time-bound," "approval to activate," or "reduce standing privileged access."

⚠️ Common Misconception: An eligible assignment grants the role's permissions. It grants only the right to activate: until activation, the user wields nothing; after the activation window (1–8 hours typically), power evaporates again. Eligible ≠ active is the distinction driving most PIM questions — including audit stems ("why does the sign-in log show no admin?" — the role wasn't active then).