Vault Security research · July 2026 · fictional illustrative guide
"Zero trust" has been marketed into meaninglessness, so let us define it narrowly: no identity gets standing access it does not currently need, and every access decision is made on evidence, not network location. In a multi-cloud estate, that program is identity-first or it is fiction. This guide is the roadmap we run with customers, in the order that survives contact with production.
1. The perimeter myth
On-prem, the perimeter was at least a place. Across two or three cloud providers it is a metaphor — your "network edge" is thousands of API endpoints, each gated by identity, not by topology. Read recent cloud-breach post-mortems and the pattern repeats: nobody breached a firewall. A credential was phished, a token was leaked, an over-privileged role was assumed, and the attacker logged in. The control plane is identity; treating network segmentation as the primary defense is defending the moat of a castle that no longer exists.
2. Policy text lies
The written policy is the map, not the territory. What an identity can actually do is the composition of at least five layers: direct policy attachments, group membership, assumable-role chains, resource-side policies, and organization-level boundaries — and each cloud provider composes them differently.
The classic failure: an analyst account labeled read-only that can assume a CI deployment role, which writes to production. Read the analyst's policy document and everything looks fine; compute the closure of what it can reach and it is a production-write identity with a friendlier name. Effective-permission analysis means computing that closure for every identity — the full set of assumption chains resolved to concrete actions on concrete resources. It is not feasible by hand past a few dozen identities; tooling (ours or anyone's) is the entry fee for the rest of this roadmap.
3. The non-human identity problem
In the estates we analyze, service accounts, access keys, and workload identities outnumber humans somewhere between three and ten to one — and they get a fraction of the governance. Humans offboard through HR; a service account created for a 2023 migration offboards never. Keys don't take parental leave, so nobody notices they haven't been used in a year.
Two numbers to establish early. First, rotation age: the median age of your access keys, with anything past 90 days on a named list. Second, the unused-privilege share: comparing granted permissions against 90 days of actual usage, typical estates show 60–80% of granted privilege never exercised — an observation from our own customer base, not a universal law, but we have yet to meet the estate where the number was small. Every unused permission is blast radius you are carrying for free.
Zero trust is not a product you install. It is a debt you pay down — measurably, in phases.
4. Just-in-time elevation: the cultural unlock
The end state is that standing admin access simply does not exist. Engineers request elevation for a task; a policy or a human approves it; the grant expires on a timer — four hours is a defensible default — and the whole transaction lands in the audit log. "Who has production access?" becomes "who used production access, when, and for what?" — a question with an answer instead of a shrug.
Be honest about what breaks when you try. Cron jobs and pipelines that quietly assumed a standing admin role will fail — inventory them first (your effective-permission analysis already found them). On-call engineers will fear approval latency at 3 a.m. — solve it with pre-approved elevation templates for defined incident roles, and a break-glass path that works instantly but pages leadership and gets reviewed within a business day. Teams stop resisting JIT the first time an elevation log answers an incident question in minutes.
5. The crawl–walk–run roadmap
Crawl — visibility (weeks 1–6). Entry criteria: read-only connections to every cloud and your identity provider. Actions: inventory all identities, compute effective permissions, tag every non-human identity with an owner, delete credentials belonging to departed people (there will be some; do not be embarrassed, be fast). Exit metric: 100% of identities inventoried, orphaned credentials at zero.
Walk — reduction (weeks 6–16). Entry criteria: the inventory is stable for two consecutive weeks. Actions: remove unused privilege starting with the highest-blast-radius roles, shipping each change as a reviewable policy pull request; rotate every key past 90 days; build the third-party access register. Exit metric: the unused-privilege share is visibly falling — from a typical 70% toward 40% is a realistic first quarter — and median key age is under 90 days.
Run — just-in-time (quarter two onward). Entry criteria: the reduction curve has flattened; what remains is privilege people actually use. Actions: convert standing admin to JIT elevation role by role, define break-glass, set approval-latency SLOs. Exit metric: standing admin near zero, median grant at or under four hours, approvals under five minutes.
6. The metrics that prove it
| Phase | Metric | Healthy target |
|---|---|---|
| Crawl — visibility | Identities inventoried, human and non-human | 100%, orphaned credentials at zero |
| Crawl — visibility | Effective permissions computed per identity | Every production-reaching identity |
| Walk — reduction | Unused-privilege share (90-day window) | Falling quarter over quarter |
| Walk — reduction | Median access-key age | Under 90 days |
| Run — just-in-time | Standing admin grants | Near zero, break-glass only |
| Run — just-in-time | Median elevation grant duration | 4 hours or less |
| Run — just-in-time | Elevation approval latency | Under 5 minutes |
Report these to leadership monthly, with denominators. A zero-trust program that cannot show a falling number is a rebranding exercise; one that can is the rare security initiative that gets its budget renewed without a fight.
This guide is published by Vault Security, a fictional company, as part of a sample website. Figures describe typical observations, not guarantees; your estate will differ.