01
Discover
Find privileged accounts, credentials, entitlements and identities across the estate.
ARCON Identity Security Platform
Converged Identity · Explained
What is Runtime Privilege Security?
Privilege that stays switched on after the work is done is one of the easiest paths an attacker can take. That applies to an admin session, but also to an application role, a cloud entitlement or a secret. Runtime Privilege Security removes the opening across every identity and every kind of access, granting privilege only when a task needs it and taking it away when the task ends.
Privilege
at runtime
at runtime
Definition
Runtime Privilege Security, defined.
Runtime Privilege Security is the operating model of ARCON's Converged Identity platform. In it, no identity holds access or elevated rights by default, whether that is an admin account, an application entitlement or a cloud role. Privilege is granted only at the moment of action, when a person, machine or AI agent needs it for a specific task.
Before granting it, ARCON evaluates identity, context, intent, policy and risk: who is asking, from where, what they are trying to do, whether policy allows it, and how risky it is. It then delivers the minimum privilege the task needs—just-in-time, just-enough privilege—monitors every session and action while it is in use, and removes it automatically when the task ends. The result is zero standing privilege, with a complete, auditable record of who did what, when and why.
Converged Identity
What we mean by privilege.
Runtime Privilege Security applies beyond administrator accounts to every identity and every form of access across the platform.
Module
What it does
Its role in Runtime Privilege Security
Identity governance and administration (IGA)
What it doesJoiner-mover-leaver lifecycle, access requests, reviews and segregation of duties
Its role in Runtime Privilege SecurityDecides who is eligible for access, and removes entitlements no one needs anymore
Workforce access management (SSO, federation)
What it doesOne sign-in across applications, federation with partners and cloud services
Its role in Runtime Privilege SecurityConfirms who is asking, and passes identity and context into every runtime decision
Multi-factor authentication (MFA)
What it doesStrong and adaptive authentication
Its role in Runtime Privilege SecurityRaises assurance at the moment of risk, such as step-up before a sensitive action
Privileged access management (PAM)
What it doesVaulting, credential brokering, session management and recording
Its role in Runtime Privilege SecurityDelivers just-in-time, just-enough privileged access, and controls every session and command
Endpoint privilege management (EPM)
What it doesControlled elevation on servers and workstations
Its role in Runtime Privilege SecurityElevates a specific application or command only when needed, instead of standing local admin rights
Cloud infrastructure entitlement management (CIEM)
What it doesMaps identities to cloud entitlements across AWS, Azure and GCP
Its role in Runtime Privilege SecurityRight-sizes cloud roles, and reclaims dormant and excessive access
Secrets and credential vault
What it doesStores and issues secrets, keys and tokens
Its role in Runtime Privilege SecurityGives machines, workloads and AI agents short-lived credentials instead of hard-coded ones
Security compliance management
What it doesContinuously assesses systems against security and configuration baselines, with exception management, remediation workflows and audit-ready reports
Its role in Runtime Privilege SecurityKeeps systems hardened and compliant, flags drift, and makes exceptions approved, time-bound and closed
Behaviour and risk analytics
What it doesBaselines activity and scores risk
Its role in Runtime Privilege SecurityFeeds the Adapt step: changes or stops access when behaviour or risk changes
Each module works on its own. Together, they turn every access decision, privileged or not, into a runtime decision.
The runtime lifecycle
Privilege exists only for the work.
Every privileged request moves through one continuous, evidence-producing lifecycle.
02
Verify
Confirm the identity and its context: device, location, time and risk.
03
Authorise
Evaluate the intent of the request—the task, command or resource—against policy and risk, with approvals where required.
04
Deliver
Grant just-in-time, just-enough privilege and broker credentials without exposing them.
05
Monitor
Record and control the session and each privileged action.
06
Adapt
Change or stop access if risk or behaviour changes.
07
Revoke
Remove privilege automatically when the task or time window ends.
08
Evidence
Keep an audit trail of every decision, session and action.
Standing vs. runtime
Close the door between tasks.
Standing privilege leaves a reusable path. Runtime privilege keeps the attack surface close to zero until verified work requires access.
Control
Standing privilege
Runtime privilege
When access exists
Standing privilegeAlways on, until someone removes it
Runtime privilegeOnly for the task or time window
How much access
Standing privilegeBroad admin rights ‘just in case’
Runtime privilegeJust enough for the specific task
Credentials
Standing privilegeShared, stored or known by the user
Runtime privilegeBrokered or injected, never exposed
Decision point
Standing privilegeOnce, when the account is created
Runtime privilegeEvery request, based on context, intent, policy and risk
Control during use
Standing privilegeLimited or tool-specific
Runtime privilegeEvery session and action monitored and controllable
Removal
Standing privilegeManual reviews, often missed
Runtime privilegeAutomatic when the task ends or risk changes
Audit evidence
Standing privilegePieced together from logs
Runtime privilegeCaptured continuously, per decision and action
Attack surface
Standing privilegeGrows with every new admin, vendor, bot and AI agent
Runtime privilegeStays close to zero between tasks
One connected model
How the familiar controls fit together.
Term you know
What it means
How Runtime Privilege Security uses it
Privileged access management (PAM)
What it meansTools that control, monitor and audit elevated access: vaulting, session management and credential rotation.
How Runtime Privilege Security uses itWhere runtime privilege began: privileged sessions decided and delivered at the moment of action. One module of the platform, not the whole of it.
Just-in-time (JIT) access
What it meansPrivilege granted only when requested and only for a limited time.
How Runtime Privilege Security uses itWhen privilege exists: for the task, then gone.
Just-enough privilege (JEP) / least privilege
What it meansOnly the rights needed for the task.
How Runtime Privilege Security uses itHow much privilege: scoped to the task, command or resource.
Zero standing privilege (ZSP)
What it meansNo identity holds always-on elevated rights.
How Runtime Privilege Security uses itThe outcome: nothing to steal between tasks.
Session and action control
What it meansMonitoring, recording and blocking of privileged activity.
How Runtime Privilege Security uses itWhat happens during use: every session and action can be watched, recorded and stopped.
Non-human and AI-agent identity
What it meansService accounts, workloads, bots and AI agents that need privilege.
How Runtime Privilege Security uses itWho it covers: the same runtime controls for machines and agents as for people.
JIT decides when. JEP decides how much. Session control governs what happens. Zero standing privilege is the result. Runtime Privilege Security brings all four together in one lifecycle.
Runtime authorization
Runtime Privilege Security vs. runtime authorization.
Runtime authorization checks each action an identity tries to take. That check is valuable—and one part of Runtime Privilege Security, which also governs whether privilege should exist, how much, and for how long.
Dimension
Runtime authorization
Runtime Privilege Security
Core question
Runtime authorizationShould this action be allowed?
Runtime Privilege SecurityShould this privilege exist right now, and how much of it?
What it controls
Runtime authorizationThe allow or deny decision on each request
Runtime Privilege SecurityThe whole lifecycle: discover, grant, scope, monitor, revoke and evidence
Standing privilege
Runtime authorizationCan still exist behind the policy check
Runtime Privilege SecurityRemoved; privilege exists only for the task
Credentials
Runtime authorizationOften out of scope
Runtime Privilege SecurityVaulted, brokered and rotated; never exposed to the user or agent
Typical focus
Runtime authorizationAI agents and API calls
Runtime Privilege SecurityAdministrators, employees, vendors, machines, workloads and AI agents
Environments
Runtime authorizationMostly cloud-native
Runtime Privilege SecurityCloud, on-premises, legacy and air-gapped estates
Audit
Runtime authorizationDecision logs
Runtime Privilege SecurityDecisions plus full session and action evidence
Runtime authorization checks the action. Runtime Privilege Security governs the privilege behind it.
Access management
Runtime Privilege Security vs. access management.
Access management establishes identity and opens a session. Runtime Privilege Security governs the access and elevated rights used after sign-in.
Dimension
Access management
Runtime Privilege Security
Core question
Access managementIs this really you, and can you sign in?
Runtime Privilege SecurityWhat should you be able to do right now, how much, and for how long?
Unit of control
Access managementThe sign-in and the session token
Runtime Privilege SecurityThe privilege itself: an admin right, application role, cloud entitlement, secret or command
Standing access
Access managementEntitlements granted in each application usually stay in place
Runtime Privilege SecurityRemoved; privilege exists only for the task
Credentials
Access managementFederated sign-in; privileged and shared account passwords are out of scope
Runtime Privilege SecurityPrivileged credentials vaulted, brokered and rotated; never exposed to users, machines or AI agents
Control during use
Access managementSession can be re-checked or ended
Runtime Privilege SecurityEvery privileged session and command can be recorded, controlled and blocked
Identities covered
Access managementMainly workforce and customer users signing in to applications
Runtime Privilege SecurityPeople, service accounts, workloads, machines and AI agents, including those that never use SSO
Environments
Access managementCloud and SaaS applications
Runtime Privilege SecurityCloud, SaaS, on-premises, legacy, OT and air-gapped estates
Evidence
Access managementSign-in and session logs
Runtime Privilege SecurityEvery decision, session and action, captured continuously
Access management opens the door. Runtime Privilege Security decides what happens once someone, or something, is inside.
FAQ
Frequently asked questions.
Built for people, machines and AI agents.
Turn every privileged access decision into a runtime decision.
Give people, machines and AI agents only the privilege they need, for only as long as they need it.