selfgranted

Selfgranted refers to a scenario in which an entity obtains or asserts privileges for itself without an external authorization step. In information security and access control, self-granting describes permissions or credentials that are issued by a system or process to the requester without going through the normal approval or governance workflow. This can occur when policies are misconfigured, service accounts or tokens are created with excessive rights, or applications are allowed to modify their own privileges.

Causes include misconfigured identity and access management policies, overly permissive token lifetimes, or automation scripts that escalate privileges inadvertently. Self-granting commonly manifests as overly broad access tokens, self-issued credentials, or the ability to modify access control lists without review.

Impact can be significant: it undermines least privilege, complicates auditing, increases the risk of leakage or misuse, and hampers incident response. It is considered a security anti-pattern and a red flag in compliance reviews.

Prevention and response rely on strong governance: implement explicit authorization checks for privilege changes, enforce least privilege and necessity-based access, use short-lived credentials, require external approval for elevation, monitor and log privilege changes, and enforce immutable or versioned policies. Regular audits and automated remediation can detect and revoke self-granted privileges.

As a term, selfgranted is used mainly in discussions of security, IAM, and policy design, and its precise meaning can vary by domain. The common thread is the absence of external authorization for privilege grants.