What breaks when access certification does not cover entitlement state and separation of duties?

When certification is limited to basic attestation, organisations can approve access without understanding the actual entitlement state or conflicting duties. That creates blind spots for over-privilege, policy violations, and audit failure. A strong programme needs current access data, workflow controls, and SoD checks so reviewers can validate whether access is still appropriate.

Why This Matters for Security Teams

access certification fails the moment it becomes a paperwork exercise instead of a control over actual entitlement state. For non-human identities, that gap is especially dangerous because service accounts, API keys, and automation tokens can accumulate permissions that reviewers never see. The result is not just stale access, but invisible separation of duties conflicts, policy drift, and approvals that look clean while the environment is already over-privileged. NHI Mgmt Group reports that 97% of NHIs carry excessive privileges, which helps explain why basic attestation so often misses the real risk.

This is why practitioners should treat certification as an evidence-backed review, not a checkbox. The OWASP Non-Human Identity Top 10 stresses that unmanaged NHI sprawl and weak governance create persistent exposure, while NIST SP 800-53 Rev. 5 Security and Privacy Controls makes the broader expectation clear: access governance has to be tied to authoritative state, not memory or assumption. In practice, many security teams discover entitlement drift only after an audit exception, a production incident, or a failed segregation review has already exposed the control gap.

How It Works in Practice

A certification process that actually protects entitlement state starts with current inventory, not reviewer memory. The reviewer needs to see what the identity can do right now, which systems it can reach, which roles or policies grant that reach, and whether any duties conflict. For NHIs, that often means pulling data from IAM, PAM, secret stores, CI/CD, cloud policy engines, and application-level permissions into a single review record. Without that aggregation, the reviewer may approve an account that looks low-risk at the directory layer while retaining powerful access in downstream services.

Effective programmes usually include three checks:

• Entitlement state validation, so reviewers see active grants, inherited access, and last-used evidence.
• Separation of duties evaluation, so conflicting combinations are flagged before approval.
• Workflow enforcement, so exceptions require explicit justification, escalation, and time-bound remediation.

That approach aligns with the governance direction in the OWASP Non-Human Identity Top 10 and with the lifecycle and visibility themes in Ultimate Guide to NHIs, which emphasises that identity risk is created by unmanaged access state as much as by credential exposure. In a mature workflow, approvers should not be asked “Should this account exist?” alone; they should also be asked “What is this account still entitled to do, and does that violate any SoD rule?” These controls tend to break down when entitlement data is split across multiple cloud tenants and legacy apps because no single system holds the full access picture.

Common Variations and Edge Cases

Tighter certification often increases operational overhead, requiring organisations to balance stronger assurance against reviewer fatigue and data quality constraints. The hard part is not the review form, but the evidence model behind it. If entitlements are poorly normalised, SoD logic can generate noisy exceptions that teams learn to ignore. If evidence refresh is too slow, reviewers certify yesterday’s access and miss today’s escalation.

Current guidance suggests that organisations should distinguish between human reviews and machine-enforced controls. For high-risk NHIs, certification should be paired with automated policy checks, while low-risk service accounts may use periodic sampling plus event-driven revalidation after role changes, pipeline changes, or secret rotation. There is no universal standard for this yet, but best practice is evolving toward continuous access validation rather than annual attestation alone. NHI Mgmt Group’s analysis also shows that only 5.7% of organisations have full visibility into their service accounts, which makes incomplete certification data a structural problem rather than a process mistake.

Where this model struggles most is in fast-moving DevOps and agentic environments, where access changes through pipelines faster than reviewers can meaningfully certify them. In those cases, the control must shift upstream into policy-as-code and real-time entitlement checks before the review step can be trusted.

Related resources from NHI Mgmt Group

• What breaks when access reviews and segregation of duties are still handled manually at enterprise scale?
• What breaks when access certification and role governance are weak in an IGA programme?
• What breaks when access certification and privileged access monitoring are not aligned across cloud and enterprise systems?
• What breaks when organisations rely on aging GRC processes for access certification and SoD management?