Standing privilege often survives because it feels operationally convenient. But convenience is not the same as necessity.
The better pattern is to separate identity from privilege: authenticate continuously, approve based on context, elevate only for the task, and remove access automatically when the task ends.
Start with a narrow administrative workflow. Measure time-to-access, exception rates and the amount of standing privilege removed.