# Identity, Authority, And Separation Of Duties

JIT/time-bound access versus standing privilege, and separation of duties for approvals.

- JIT (just-in-time), target-scoped, time-bound access is the AC-2 account-management alternative to standing administrative privilege.
- Separation of duties (AC-5) requires the request, approval, and execution principals to be distinct for a gated action.
- A shared or unidentified identity breaks attribution, making it impossible to tie an action back to an accountable individual.

## Sources

- https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final
- https://csrc.nist.gov/glossary/term/separation_of_duty