1 min lesson
Least-privilege & JIT access
Describe what "Build a least-privilege and JIT system for cloud access that enables engineers without granting unnecessary standing permissions" changes in practice.
Step 1 of 2
Cursor's job description names one project outright: build a least-privilege and JIT system for cloud access that enables engineers without granting unnecessary standing permissions. If you walk into the onsite with a clean design for this, you are answering the question they wrote down.
The threat you are designing against is mundane and constant. An engineer's laptop gets phished, a CI token leaks into a build log, a session cookie is stolen. The damage is bounded by exactly one thing: what that identity could do at the moment of compromise. Standing access is the variable you control.
So the first principle is blunt. Permanent permissions are stored attacker value, sitting there whether anyone uses them or not.
Every role a human or service holds 24/7 is a permission an attacker inherits the instant they take over that identity. The goal is not to make access hard. It is to make most access absent most of the time, so that on any given Tuesday the blast radiusHow much breaks if a change goes wrong; the scope of potential damage. Press Enter for the full definition. of a stolen credential is close to nothing.