Just-in-time access

Instead of somebody holding admin rights permanently, they request them when they need them and the rights expire shortly afterwards.

The effect is to shrink the window. Standing privilege means a stolen account is powerful whenever it is stolen. Just-in-time access means it is powerful only during the half hour somebody was actually doing the work. It also produces a record of who needed what and when, which is usually the first time anybody discovers how rarely those permanent rights were being used at all.