A normalised map of identities, roles, tokens, and service accounts linked to the sensitive data stores they can reach. It turns scattered entitlements into an evidence-based view of who can access what, through which path, and under which controls.
Expanded Definition
A data access graph is more than a list of permissions. It is a normalised relationship model that connects human and non-human identities, roles, tokens, service accounts, and the data systems they can reach, so teams can trace access paths end to end. In NHI security, this matters because effective governance depends on visibility across direct grants, inherited permissions, temporary elevation, and machine-to-machine delegation.
The term is still evolving across vendors and platform teams, so definitions vary. Some tools emphasise entitlement inventory, while others focus on graph traversal across identities, workloads, and data stores. The operational value is the same: it shows where access exists, how it is obtained, and whether controls such as RBAC, JIT, and Zero Trust Architecture are actually reducing exposure. NHI Management Group frames this visibility as foundational to understanding risk, especially when service accounts and API keys are distributed across cloud, CI/CD, and data pipelines. See the Ultimate Guide to NHIs and the OWASP Non-Human Identity Top 10 for broader identity-risk context.
The most common misapplication is treating a data access graph as a static entitlement export, which occurs when organisations ignore inherited, indirect, or time-bound access paths.
Examples and Use Cases
Implementing a data access graph rigorously often introduces modelling and reconciliation overhead, requiring organisations to weigh visibility and control against the effort of continuously normalising identity and permission data.
- A cloud security team maps a service account to a production database through an IAM role chain, revealing access that was never captured in the original RBAC review.
- A governance team uses the graph to identify API keys that can reach customer records through a CI/CD integration, then compares those paths with the controls described in NIST SP 800-53 Rev 5 Security and Privacy Controls.
- An incident response team traces a compromised token back to the databases it could query, then isolates every derived path before the attacker can pivot further.
- An IAM programme uses the graph to detect dormant NHI paths that still lead to sensitive data, even when the owning application has been decommissioned.
- A review team compares the graph against the findings in Ultimate Guide to NHIs, Key Challenges and Risks to prioritise remediation for overly broad machine access.
Why It Matters in NHI Security
Without a data access graph, organisations often know that a secret exists but not what that secret can reach. That gap is dangerous because NHIs outnumber human identities by 25x to 50x in modern enterprises, and NHI Management Group reports that only 5.7% of organisations have full visibility into their service accounts. In practice, poor visibility means excessive privileges, orphaned tokens, and hidden pathways to sensitive datasets remain active long after the original business need has ended. A data access graph gives security, data, and platform teams a shared evidence base for reviewing exposure, enforcing least privilege, and validating that controls are not just documented but actually effective.
It also supports prioritisation. When paired with research such as the Ultimate Guide to NHIs, Key Research and Survey Results, the graph helps teams focus on the highest-risk paths first, especially where third-party access or long-lived credentials expand blast radius. Organisational blind spots often remain invisible until a breach, an audit failure, or an urgent access review exposes them, at which point the data access graph becomes operationally unavoidable to reconstruct what actually happened.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 address the attack and risk surface, while NIST CSF 2.0, NIST SP 800-63, NIST Zero Trust (SP 800-207) and NIST AI RMF set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-01 | Graphing NHI-to-data paths supports discovery of overexposed identities and hidden access paths. |
| NIST CSF 2.0 | PR.AC-1 | Access control requires visibility into who and what can reach protected resources. |
| NIST SP 800-63 | Identity assurance principles inform how machine identities are bound to reachable resources. | |
| NIST Zero Trust (SP 800-207) | PA-3 | Zero trust depends on continuous understanding of subjects, assets, and access paths. |
| NIST AI RMF | MAP | Mapping data access relationships supports risk identification and governance for AI-enabled systems. |
Inventory every NHI path to data stores and remove any relationship that cannot be justified.
