Introducing 1Password Privileged Access: Zero standing privileges for every identity

Here's a moment that comes up in nearly every compliance review: a security engineer pulls a list of IAM roles in the AWS environment. The list is long. Some roles were created for a migration project that closed two quarters ago, a few belong to contractors who haven't worked there in over a year, and others are attached to agentic identities without any way to see which human they were acting on behalf of. There's no ticket to clean them up, no alert when the access outlived its purpose, and no record of who approved it in the first place.

That's standing access in practice; that long list of overprovisioned IAM roles is simply the product of how access has always been provisioned. Admins create it when the work starts, then rely on someone else to clean it up when it's done. But the cleanup rarely happens. The gap between the access granted and the access that's actually needed becomes the gap that shows up in audit findings, and that attackers learn to exploit.

That problem has grown harder to manage as AI agents have joined human engineers in operating on production infrastructure. Agents don't request access through a ticket queue. They act continuously, respond to changing inputs, and can be steered in ways that static standing permissions were never designed to contain. Governing agents with the same legacy PAM tools built for human logins carries the risk forward instead of containing it.

That’s why we're introducing 1Password Privileged Access. It brings Apono’s proven just-in-time access engine into the 1Password Unified Access platform, eliminating standing privileges for both human and agent identities across cloud and hybrid environments, databases, and Kubernetes. Access is created at the moment of the request, scoped to the task, and deprovisioned automatically when the work is done.

Standing access became the default, and the cost kept growing

Cloud infrastructure can change by the hour. New services get spun up, roles get reshuffled, and permissions…