Entitlements, separation-of-duties controls, approval evidence, time-bound grants and certification campaigns.
Zero-standing privilege: privileged access is capped by the entitlement, requires two independent approvers, and expires automatically. Toxic combinations are blocked before approval.