Your provider says per-engagement admin grants break its 15-minute response SLA — do you keep standing access?

## Read the objection before answering it *Per-engagement grants break our fifteen-minute SLA* is a real operational claim, and dismissing it makes you the security person nobody consults. It is also almost always **over-scoped**: the SLA governs emergency response, while the majority of a provider's work is scheduled, ticketed and entirely compatible with waiting three minutes for an approval. So the first move is measurement, not argument: over the last quarter, how many engagements invoked the emergency clock, and what did they actually need to do? A book where four percent of work is emergency response does not justify standing top-level privilege for the other ninety-six. ## Design that satisfies both claims Two paths, not one: **Routine path.** Elevation is requested against a piece of work, approved on the client side, scoped to the least sufficient role, and expires automatically. Latency measured in minutes, which no scheduled work notices. **Break-glass path.** A pre-approved emergency grant the provider can **self-activate without waiting for a human**, which is what actually meets a fifteen-minute clock. Its safety comes from three properties rather than from an approver: a hard automatic expiry, the narrowest role that can plausibly serve an emergency, and a duty to justify each activation afterwards to a named owner on your side. Activation is a normal, blameless act; unexplained activation is a contract conversation. That design concedes the provider's operational point in full and still leaves nobody holding privilege at rest. If the provider accepts it, the objection is resolved and there is no risk decision to make. Most of the value of this question is knowing that the apparent trade-off is frequently false. ## When the provider genuinely cannot Some providers cannot, because their tooling assumes standing entitlements across the whole book, or because their margins do not survive per-client process. Now it is a judgment under constraint, and the components are: - **What the contract permits.** Can you require it at renewal, at a price, or not at all? A right you have and do not exercise is different from a right you never bought. - **What switching costs.** Provider migration is measured in months and real money. The alternative is rarely free, and pretending otherwise damages your credibility for the next argument. - **What partial scope reduction is available today.** This is where most of the real win lives. Drop the top-level role to two scoped roles. Exclude the crown-jewel tenant, subscription or system from the delegation entirely and administer it yourself. Ask for identities partitioned per client rather than one spanning the book — that is scheduling flexibility on their side, not money, and it is the single change that most reduces your exposure to their other clients. - **What the exposure is worth.** Name it as a figure, however rough. A risk with no number cannot be traded against an SLA that has one. - **Who signs.** The person accepting this must be someone who can actually carry the consequence — the accountable executive, not the security engineer who raised it and not the provider's account manager. Self-approval by the finding's raiser is the most common failure. ## What a defensible acceptance looks like If you accept, the acceptance must carry: the specific exposure in plain words, a named owner with the authority to carry it, the compensating reductions actually implemented, and a **review date** rather than permanence. Acceptances without expiry are how a temporary concession becomes the estate's architecture. Put the same clock on the risk that you wanted on the privilege. ## Tiering, which is the answer people forget Not every provider needs the same treatment. A provider administering your directory and your production platform is not the same counterparty as one that manages printers. Tier them: standing access is a privilege that a small number of providers earn through demonstrated operating practice, and everyone else works per engagement. That converts an argument you have two hundred times into a policy you defend once, and it gives the provider something to gain rather than only something to lose. ## The failure modes to avoid out loud - **Absolutism.** *Standing administration is never acceptable* ends the conversation and gets you excluded from the next one. - **Paper for prevention.** Accepting standing access in exchange for a quarterly attestation trades a control for a document. - **Indemnity as risk reduction.** A liability clause reallocates cost after the fact; it does not shorten the privilege. Useful, but not an answer to this question. - **Leaving it undecided.** An unresolved objection defaults to standing access, permanently, with nobody's name on it. Deciding badly and writing it down beats not deciding. ## The one-line version *Meet the fifteen minutes with self-activating break-glass on a hard clock, put everything else behind approval, and if the provider still cannot, get scope reduction and per-client partitioning now, then have someone with real authority accept the remainder in writing with a date on it.*