Access certification routing is the rule set that determines which reviewer should receive a certification item, usually based on application ownership or manager relationship. When routing depends on mapped identity data, reviews land with the right approver instead of a shared mailbox or an unqualified reviewer.
Expanded Definition
access certification routing is the control logic that determines which reviewer receives a certification item, such as an application owner, a line manager, or a delegated approver. In NHI governance, the term matters because service accounts, API keys, and workload identities often sit outside human HR structures, so routing must rely on authoritative identity and ownership data rather than a generic queue. Where mappings are incomplete, the process becomes a workflow problem and a security gap at the same time.
Definitions vary across vendors on whether routing is part of certification design, entitlement governance, or workflow orchestration. NHI Management Group treats it as a governance decision that should preserve reviewer accountability, prevent approval collisions, and support evidence quality for audits. Standards such as the OWASP Non-Human Identity Top 10 and NIST SP 800-53 Rev 5 Security and Privacy Controls do not name the term directly, but they reinforce the need for controlled review, accountable authorization, and traceable access decisions. The most common misapplication is routing certifications to a shared mailbox, which occurs when ownership data is missing or stale and no authoritative mapping exists.
Examples and Use Cases
Implementing access certification routing rigorously often introduces dependency on clean ownership data, requiring organisations to weigh faster review cycles against the cost of maintaining accurate mappings.
- An application entitlement review routes to the named product owner because the asset inventory links the app to a specific business unit, rather than to a generic IAM queue.
- A service account certification is routed to the platform team lead because the account is mapped to a Kubernetes cluster owner, not to the human manager of the engineer who created it.
- A quarterly access review for a CI/CD secret lands with the DevOps manager after the routing rule resolves the owning team from the secret inventory, reducing back-and-forth during approval.
- A delegated approver receives a certification only after the primary reviewer is on leave, which prevents stalled queues while preserving a documented approval path.
- Routing rules send orphaned entitlements to a governance exception queue so they can be remediated before the certification cycle closes.
For broader identity governance patterns, NHI Management Group’s Ultimate Guide to NHIs is useful context, while the OWASP guidance helps align the review process with entitlement risk. The same logic applies in breach investigations where ownership ambiguity slows decision-making, as seen in the 52 NHI Breaches Analysis.
Why It Matters in NHI Security
Access certification routing is a security control because the right reviewer is often the difference between timely revocation and access persisting unchallenged. When routing is wrong, certifications are approved by people who cannot judge the risk, or they remain unreviewed long enough for excessive privileges to accumulate. That matters especially for NHIs, where ownership is frequently distributed across platform, application, and security teams. NHI Management Group reports that only 20% of organisations have formal processes for offboarding and revoking API keys, a gap that makes reviewer accuracy critical when access decisions are being certified.
Routing also shapes evidence quality. If the approval trail lands in an unmonitored queue, audit records become weak even when the underlying access decision was correct. The Ultimate Guide to NHIs and the Sisense breach illustrate how weak identity governance compounds into larger compromise paths. Organisations typically encounter the consequences only after a failed recertification, a missed revocation, or an audit exception, at which point access certification routing becomes operationally unavoidable to address.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 address the attack and risk surface, while NIST CSF 2.0, NIST SP 800-63, NIST Zero Trust (SP 800-207) and NIST AI RMF set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-08 | Routing depends on accurate ownership and reviewer accountability for NHI reviews. |
| NIST CSF 2.0 | PR.AA-05 | Access decisions should be reviewed by authorized parties with clear accountability. |
| NIST SP 800-63 | Identity proofing and identity resolution depend on reliable authoritative attributes. | |
| NIST Zero Trust (SP 800-207) | Zero Trust requires continuous access decisions with explicit, attributable review. | |
| NIST AI RMF | Governance requires traceable human oversight over operational decisions and exceptions. |
Treat certification routing as a governed oversight process with clear escalation and exception handling.
