Introducing 1Password Privileged Access: Zero standing privileges for every identity

1Password Privileged Access governs access across three areas where standing privilege tends to accumulate and can do the most damage if left unmanaged: Access Discovery maps every identity and existing permission across cloud and hybrid environments: AWS, Azure, GCP, Kubernetes, hybrid infrastructure, and databases. It surfaces dormant accounts and permissions that are broader than the work actually requires, giving security teams a clear starting point for eliminating standing access. Runtime Privilege Orchestration and Dynamic Guardrails replace standing permissions with access created at the moment it's needed. When an engineer requests access to an AWS IAM role, a database, or a Kubernetes namespace, 1Password Privileged Access creates that access directly in the native policy language of the target system, not through a session proxy or a bastion host. The access exists for the duration of the session and is deprovisioned automatically when the work is done.

No standing role is left behind. The approval model is built around context, not just identity. Every request factors in who is asking, what environment they are touching, and how sensitive the resource is. Low-risk requests clear automatically by policy. Higher-risk requests route to a human reviewer.

Engineers submit from wherever they already work – Slack, the CLI, Teams, Jira, or an MCP server – without adding a new tool to the flow. The access model changes, but the way engineers work doesn't have to. AI Agent Privilege Control extends the same model to AI agents. Agents typically inherit the standing access of whoever deployed them. These are permissions sized for a human workflow, not scoped to a specific automated task.

An agent running a data pipeline doesn't need access to your entire secrets vault, and a copilot handling customer queries doesn't need write access to production infrastructure.