Privileged access programs were designed for environments where access could be defined ahead of time. That assumption no longer holds in the cloud. Legacy PAM emerged in a world of static infrastructure, long-lived systems, and a relatively small number of privileged users. Access patterns were predictable. Roles could be created in advance, assigned broadly, and reviewed periodically. That model was imperfect, but it worked well enough.