P0 Security has announced new capabilities for its privileged access control plane that it says deliver a closed-loop Zero Standing Privilege (ZSP) model across production environments. The update is designed to replace long-lived, over-privileged access with short-lived, least-privilege, auditable access for human users, machine identities, and first-party AI agents, positioning ZSP as an operational default rather than an aspirational governance target.
The release introduces a privilege governance module that combines posture assessment, guided policy design, and runtime policy conversion. Posture analysis flags privilege sprawl, unused access, over-permissioned roles, and orphaned credentials so security teams can identify and remediate standing privileges. A Policy Studio then uses those signals and customer-defined governance rules to create least-privilege policies, which are converted into controls that are enforced natively and consistently across production systems. Continuous visibility, policy generation, and automatic enforcement are meant to form a feedback loop, with audit logging and replay at the session level providing verification for compliance and incident response.
P0 is also introducing early-access agentic governance features for AI agents operating on platforms such as AWS Bedrock and Google Vertex. The controls include right-sizing privileges per agent, human-in-the-loop just-in-time approvals when agents request access to data or cloud resources, and detailed session telemetry that links every action back to a specific agent and human sponsor. The company argues that applying the same governance model across human, machine, and agentic identities allows organizations to keep AI workflows within a unified privileged access framework rather than bolting on separate controls.
For CISOs, the pitch is that P0’s closed-loop ZSP can reduce the attack surface created by static admin roles, long-lived credentials, and poorly governed machine identities while keeping developers’ workflows relatively frictionless. By tying continuous discovery and posture assessment directly into policy generation and runtime enforcement, the platform is targeting familiar risks such as lateral movement and credential theft, and emerging risks around AI agents operating with excessive privileges or opaque audit trails.
Sources: Identity Week, P0.dev
—
By Ali Nassar-Smith
