Just-in-time (JIT) elevation in Devolutions PAM has two variations: elevating a standard account or a zero standing privileges (ZSP) account.
Standard account: This account has existing memberships. JIT adds additional groups or roles upon check-out that are subsequentially removed upon check-in.
ZSP account: This account has no permissions or memberships at rest. Memberships are added at check-out and removed upon check-in, similar to standard accounts. The operational security team can monitor these accounts to ensure they remain empty of memberships at rest.
CyberArk: On-demand