Because people optimise for task completion when the control adds delay, confusion, or repeated effort without an obvious security benefit. In practice, that can lead to session sharing, exception requests, or avoidance of stronger authentication. Usability failures therefore become security failures once the workaround is easier than compliance.
Why Strict Identity Controls Trigger Workarounds
People do not resist identity controls because they dislike security. They resist controls that create repeated friction without a clear task benefit. When authentication is slow, exceptions are hard to obtain, or access rules interrupt urgent work, users improvise. The result is predictable: shared sessions, copied tokens, informal approvals, and shadow processes that bypass the control entirely.
This matters because the workaround often becomes the real access path. In NHI environments, that can expose service accounts, API keys, and automation credentials to broader use than intended. NHI Management Group notes that 79% of organisations have experienced secrets leaks, with 77% of those incidents causing tangible damage, which shows how quickly convenience-driven bypasses turn into operational risk. The pattern is familiar in incidents documented in the 52 NHI Breaches Analysis and the Ultimate Guide to NHIs.
Security teams often discover the control problem only after users have already built a faster unofficial path around it.
How Strict Controls Become Operational Friction
Identity controls become brittle when they are designed around policy ideals rather than how work actually flows. If a developer, analyst, or operator must reauthenticate too often, wait for manual approval, or navigate inconsistent privilege requests, they will look for the shortest path to task completion. That is not a culture problem first. It is usually a design problem.
Current guidance suggests three factors matter most: delay, repetition, and ambiguity. Delay pushes users toward shared access or cached credentials. Repetition encourages password reuse or approval fatigue. Ambiguity makes users unsure whether the control is necessary, so they bypass it. The NIST Cybersecurity Framework 2.0 frames this well by tying security outcomes to practical governance and usable protections, not just stronger rules on paper.
- Reduce unnecessary prompts by using risk-based step-up authentication instead of constant re-checks.
- Make privilege requests fast, time-bounded, and easy to understand.
- Remove hidden failure points such as unclear ownership, expired exceptions, and broken approval chains.
- Track where users create informal access paths, because that is often where the real control gap sits.
For NHIs, the same logic applies to secrets handling, rotation, and offboarding. If access is difficult to maintain through approved channels, teams will store credentials in code, notes, chat, or local scripts. NHI Management Group’s Top 10 NHI Issues and the Ultimate Guide to NHIs — Standards help frame those failure modes against lifecycle and governance expectations.
These controls tend to break down in high-tempo environments such as production support, release engineering, and incident response, because users will prioritise continuity over compliance when the approved path is slower than the business task.
Where the Tradeoff Becomes a Security Decision
Tighter identity controls often increase effort, so organisations must balance assurance against operational load. That tradeoff is real, and current guidance suggests it should be managed deliberately rather than ignored. The goal is not to remove friction everywhere. It is to place friction where risk is highest and keep routine work moving safely.
There is no universal standard for this yet, but practical approaches usually include risk-tiered access, just-in-time elevation, and better user feedback when access is denied. If users understand why a control exists and can complete the secure path quickly, they are less likely to invent a shortcut. If the control feels arbitrary, they will route around it.
For teams with heavy automation or shared operational tooling, the issue becomes sharper because one user workaround can spread across many identities. In those cases, the control design has to account for session duration, secret storage, approval latency, and auditability together. The broader lesson from NHIMG research is that weak usability does not just inconvenience users; it creates durable security bypass patterns that are hard to detect and harder to unwind.
Where organisations do not separate task urgency from access governance, they often end up with the exact insecurity the control was meant to prevent.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 address the attack and risk surface, while NIST CSF 2.0 and NIST AI RMF set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST CSF 2.0 | PR.AC | Access control must stay usable enough that users do not bypass it. |
| OWASP Non-Human Identity Top 10 | NHI-01 | Workarounds often expose secrets and create unmanaged NHI access. |
| NIST AI RMF | AI risk management requires controls that do not invite unsafe user behaviour. |
Tune identity controls to least privilege, risk, and workflow reality so users can follow the approved path.
Related resources from NHI Mgmt Group
- What breaks when identity controls create too much friction for teams?
- Why do identity controls fail when they create too much friction?
- Why do users and administrators create workarounds around security controls?
- How should security teams improve compliance and budget outcomes without making identity controls too rigid for users to work around?
