A common mistake is treating a partially implemented IGA process as if it delivers full control. In practice, partial coverage still leaves gaps in data quality, ownership, and review consistency. If reviewers cannot see all entitlements or track changes reliably, the process creates a false sense of assurance while leaving excessive or inappropriate access in place.
Why This Matters for Security Teams
Semi-manual access certification is attractive because it looks controllable: a spreadsheet, a reviewer, and a sign-off. The problem is that review activity is not the same as access assurance. If entitlement data is incomplete, owners are stale, or changes are not captured before the next cycle, the organisation ends up certifying an outdated picture rather than the real access state. That creates audit comfort without operational control.
This is especially dangerous for non-human identities, where service accounts, API keys, and automation tokens often sit outside the visibility of standard joiner-mover-leaver workflows. NHI Management Group notes that only 5.7% of organisations have full visibility into their service accounts in the Ultimate Guide to NHIs, which explains why certification exercises frequently miss the identities that matter most. The same pattern appears in breach analysis, including the 52 NHI Breaches Analysis, where weak ownership and poor lifecycle control keep recurring.
Current guidance from OWASP Non-Human Identity Top 10 and NIST SP 800-53 Rev 5 Security and Privacy Controls both points toward continuous, evidence-backed review rather than periodic rubber-stamping. In practice, many security teams discover certification gaps only after an excessive entitlement survives several review cycles, rather than through intentional control design.
How It Works in Practice
The best semi-manual programmes do not try to certify everything by hand. They use the manual review step for judgment, not for discovery. Discovery, ownership mapping, and entitlement evidence need to be automated as much as possible before certification starts. Otherwise, reviewers are asked to approve what they cannot reliably see.
For NHI-heavy environments, that means building a current inventory of accounts, tokens, keys, and vault-linked secrets, then enriching it with system ownership, last-used data, expiry, and business purpose. A reviewer should be able to answer three questions quickly: who owns this identity, what can it access, and is that access still needed. If the evidence is absent, the default should be escalation or removal, not “approve for now.”
Useful controls usually include:
- Automated entitlement extraction from IAM, PAM, cloud, and secrets systems before review begins.
- Policy-based review rules that flag orphaned, privileged, dormant, or unowned access.
- Evidence attached to each item, such as last authentication, key age, and application dependency.
- Exception handling with expiry dates, compensating controls, and named approvers.
For non-human identities, the lifecycle matters as much as the review itself. The Lifecycle Processes for Managing NHIs guidance aligns with the principle that access should be issued, validated, rotated, and revoked through traceable workflows, not left to spreadsheet memory. Where organisations need stronger operational baselines, the Key Challenges and Risks section is a useful reference for the visibility and ownership failures that undermine review quality.
These controls tend to break down in fast-moving DevOps environments because access changes faster than review evidence can be refreshed.
Common Variations and Edge Cases
Tighter certification often increases process overhead, requiring organisations to balance reviewer effort against the risk of leaving access unchecked. That tradeoff becomes real when applications are owned by multiple teams, when service accounts are embedded in pipelines, or when no single person can confidently attest to business need.
Best practice is evolving for environments where semi-manual review is the transition state, not the end state. In those cases, the right question is not whether a human approved the access, but whether the process can detect stale or excessive access without relying on memory and side channels. For example, shared technical accounts, emergency break-glass access, and third-party integrations may require separate certification paths because standard owner attestation is unreliable.
There is no universal standard for this yet, but current guidance suggests that organisations should separate human access review from NHI governance, because the failure modes are different. Human certifications often focus on job role drift, while NHI certifications need to account for machine-to-machine dependencies, token expiry, and automation sprawl. NHI Management Group’s Ultimate Guide to NHIs also notes that 71% of NHIs are not rotated within recommended time frames, which is a strong signal that review processes alone are not enough.
In practice, semi-manual certification works best as a temporary control while organisations improve inventory quality, ownership assignment, and lifecycle automation. It fails when review cadence becomes a substitute for continuous access governance.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10, OWASP Agentic AI Top 10 and CSA MAESTRO address the attack and risk surface, while NIST AI RMF and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-01 | Incomplete visibility and stale ownership are core NHI review failures. |
| OWASP Agentic AI Top 10 | Dynamic machine access needs runtime-aware review, not static sign-off. | |
| CSA MAESTRO | Agent and workload governance requires lifecycle controls beyond manual certification. | |
| NIST AI RMF | Governance and accountability are needed where automation decisions affect access. | |
| NIST CSF 2.0 | PR.AC-1 | Identity and access management must maintain accurate, current access records. |
Tie certification to workload identity, task scope, and revocation triggers across the agent lifecycle.
