All papers / No. 03 / Certification & Attestation
Access certification runs on a fixed schedule and asks whether a person still needs a given access. The control rests on one assumption: the access is still present when the reviewer opens the campaign. For a growing share of privileged access that assumption fails. Just-in-time elevation, short-lived cloud role credentials, break-glass overrides, and ephemeral AI-agent sub-identities grant powerful access that expires in minutes or hours, so the quarterly review finds nothing left to certify and the reviewer attests to a session history from memory. The mismatch is precise: the object of review does not persist, the eligibility policy that actually governs ephemeral access is never certified, and no defined unit of review exists for a grant that has already expired. A targeted survey of the literature through 2026 found no prior treatment of certification of ephemeral access grants as a distinct problem. The Session-Centric Certification Model (SCCM) answers the mismatch by moving the unit of review from the entitlement to the session: standing eligibility policies are certified on a cycle, each grant is bound to its declared intent, each session is recorded in a tamper-evident ledger, sessions are reviewed close to the event on a risk-sampled basis, and review findings feed back into granting policy. The contributions are (1) a precise characterization of the certification mismatch for ephemeral access, (2) the Session-Centric Certification Model, a five-component framework covering intent-bound grants, the session ledger, risk-sampled post-session review, policy-level certification, and a feedback loop, and (3) a mapping of the model onto IGA platforms, PAM session brokers, and cloud credential services already in operational use. SCCM is conceptual; no experimental validation, datasets, or measured results are claimed.
© 2026 Prabin Shrestha. Licensed under CC BY-ND 4.0: share unchanged with attribution; no derivatives.
Keep reading