How Runtime Authorization Eliminates Standing Privileges for Good

Today we're talking about this concept called runtime authorization.

Now, if you're involved in any projects that involve developer environments, AI, or even just general IT, you've probably heard of this term or are curious about it.

So let's dive in and discuss what runtime authorization actually means.

Now, first and foremost, let's talk about what the Z means here at the end of this word.

Because there's a concept of authentication, which means your credentials, the front door of an application or network or transaction you're trying to get to.

And that's well established.

Most people understand that. Authorization, or authZ, is what you can do once you are inside.

Now, the reason runtime authorization is getting so much buzz these days and everyone's interested in it, is because the traditional approach that we've had to runtime — or not runtime, but just authorization.

The traditional approach has been around people, it's been around machines, and it's been most recently about AI.

But let's stick with people and machines here first.

The idea is that you get your authorizations — and remember, that's what you can do after you've authenticated.

You get this more or less when you are introduced to an organization, or you're born, like for these non-human identities and the machine identities — they're born.

Service accounts are created, containers pop up in our engineering and developer environments, and at that moment they're given these permissions, and these are long-standing permissions.

That's why we call them standing permissions.

And they're all well and good, because when this machine or this user needs to get access to something, all they need to do is provide their credential and they're in.

Now, the bad news is, bad guys — they've known that for a very long time.

And the bad guys will steal those credentials.

And guess what?

Once they've stolen those credentials, they are now on to your standing permissions, your standing access, your authorizations.

And so now everything has shifted into, you know, hyper-scalable environments, cloud-based development, and AI.

So a new approach is now required.

Standing permissions are no longer the thing.

Those don't work anymore.

Now what we need is this new approach.

And this new approach is, as we've outlined, runtime — and runtime means that now you have a few more elements involved here.

You've got — you're still human, you still have machine identities, and a lot more of those machine identities, by the way.

And now you have AI agents and models, and these things are appearing in our networks, in our cloud environments, in record numbers.

We're out-ratioing our humans to machines to AI by, you know, 100 to 1, 200 to 1.

And the situation is, if all of these things have standing permissions in the cloud, then when the bad guys come in and steal something, they can get access to so much more damaging information, data, and they can really make us have some really bad days ahead.

So the idea is this principle of runtime authorization, which says, hey, I'm going to not give these things standing principles upon when they join the organization, when they're created, or when this AI model creates more agents and more AI models to get its job done.

But then you think, well, hey, if I'm a developer, that's kind of a nightmare, because I can't have a human in the middle making determinations on what each of these things needs access to at all times.

I can't have access reviews going out to say, hey, does this AI model still need access to these cloud shares and this data and these containers?

Because that's not scalable.

Everything just grinds to a halt, and we can't have that.

So that's why runtime authorization is getting a lot of buzz, because here's the key elements of it.

Runtime authorization means these things will have no permissions on the other side here.

Instead, what we will do is when this machine identity, when this AI agent needs something, we have an engine — an authorization engine, an identity security engine — that is going to come in and it's going to look here, and it's going to look here, and it's going to look here.

And the secret sauce is, we're not just looking at top-level privileges.

We're not looking at, you know, what this machine may need at this time.

We're looking at the whole context of it.

We're going into our directories and we're looking at the roles that these things have.

We're looking at how they were created and who created them.

And then we're going into a deep context inspection.

And that is not easy to do, because remember, you have credentials flying around.

You need to get in first.

So in this environment, you have keys, like SSH keys.

You have — you know — passwords sometimes built into the applications.

You have all kinds of, you know, certificates flying around.

And there needs to be some system that says, hey, I'm going to borrow that secret, that certificate, going to go in here, going to — with my proper authorizations for security — inspect what this needs in real time.

I'm going to give it — let's take this AI model here — I'm going to give that AI model what it needs to do its job right now.

And then I'm going to take it away when it's no longer needed.

And that means that when the bad guys come in here and say, I'm going to run my exploit and I'm going to do it and be in and out in 5 minutes — they're going to steal those credentials, come in here, and be stopped dead in their tracks.

Because over here on the other side, there are no standing privileges, and there's nothing that they can actually get to.

So runtime authorization is having its moment right now, but it really is the way that the identity security market — everything's going this direction — because we can't have humans in the middle.

We can't have these real-time access reviews, you know, of humans trying to determine who needs what.

We really need a dynamic environment here where context is key, and we can ultimately achieve something that we call zero standing privileges, ZSP.

These things go hand in hand.

But in order to do this, we have to have a solution in place that does runtime authorization and can do this inspection of all these elements — discover all of these things in real time, understand their context, what they need, when they need it, and then take it all away when it's no longer needed.

And that way we can sleep a little better at night, knowing that all of the identities in our environment are secure, and there's nothing on the other side for the bad guys to compromise.

So that's my overview of runtime authorization.

If this is interesting to you, head out to delinea.com and we'd love to have a conversation with you about this.