What is the difference between a traditional access review and a graph-based identity model?

A traditional access review is usually a point-in-time exercise based on lists or spreadsheets, while a graph-based identity model represents identities, roles, permissions, and relationships as connected data. The graph approach makes it easier to traverse dependencies, spot toxic role combinations, and understand access in context. That gives practitioners a more operational view of governance than a static review alone.

How the Two Models Actually Work

A traditional access review is a control event, usually periodic and retrospective. Teams validate who has access, often from export files, spreadsheets, or application reports, then decide what to keep or remove. A graph-based identity model is a data model, not just a review process. It stores identities, entitlements, roles, and relationships as linked objects so the environment can be queried as a connected system.

The practical difference is scope and navigability. A review tells you whether a named account still appears acceptable at a point in time. A graph lets you ask how access is inherited, which permissions converge on a sensitive resource, and whether a change in one place creates unintended exposure elsewhere. That is why graph models are useful for dependency analysis, not just certification.

For background on the identity and governance problems graph models are trying to solve, see NHIMG’s Ultimate Guide to NHIs and the NHI Lifecycle Management Guide, which both treat visibility, ownership, and access governance as lifecycle problems rather than isolated review tasks.

Why the Difference Matters in Practice

A spreadsheet review is usually good at confirming named access but weak at revealing hidden structure. It can miss indirect access paths, toxic combinations, and access that is technically spread across several roles or inherited through nested relationships. A graph-based model makes those paths visible because it can traverse the relationship chain rather than treating each line item as independent.

That matters most in environments where access is dynamic, highly delegated, or layered through roles, groups, application bindings, and shared infrastructure. In those environments, the question is not only “does this account have access?” but “how did this access arise, what else depends on it, and what breaks if we remove it?” A graph is better suited to answering those operational questions.

NHIMG’s Ultimate Guide to NHIs, Key Challenges and Risks and Top 10 NHI Issues are useful complements because they show how sprawl, over-privilege, and weak visibility become harder to manage when access is only reviewed as a static list.

When Each Approach Is the Better Fit

Traditional access reviews are still appropriate when the objective is formal attestation, audit evidence, or a simple governance checkpoint. They are also easier to explain to stakeholders who need a human-readable approval record. But they work best when the entitlement picture is relatively stable and the review scope is narrow enough for manual judgment to be reliable.

A graph-based identity model is the better fit when you need continuous analysis, faster impact assessment, or richer access intelligence. It is especially valuable for identifying excessive privilege, role overlap, and access chains that only become obvious when you see the full relationship structure. In other words, the review asks whether access should remain; the graph helps explain why the access exists and what else it implies.

If you are deciding which model to invest in first, treat the traditional review as a governance checkpoint and the graph as the analysis layer that makes the checkpoint smarter. The underlying data quality, ownership mapping, and entitlement normalization have to be strong enough before the graph will produce trustworthy results.

Risk and Threat Considerations

Static reviews can leave dangerous relationships hidden between review cycles, especially where privileges are inherited, duplicated, or distributed across many small entitlements. That creates exposure to privilege creep, delayed revocation, and missed toxic combinations that only become obvious when relationships are analyzed together.

Failure mechanism: The review process validates entries one by one, while the real risk sits in the interaction between entries, so indirect access paths and compound privilege states remain unnoticed until misuse or compromise occurs.

Impact: An organisation may certify access that looks acceptable on paper but still permits unauthorized reach to sensitive systems, broader blast radius after compromise, or slower containment when access needs to be removed quickly.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

OWASP Non-Human Identity Top 10 address the attack and risk surface, while CIS Controls v8 and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.

Framework	Control / Reference	Relevance
CIS Controls v8	6 — Access Control Management	Graph models improve visibility into permissions and excessive access.
	8 — Audit Log Management	Graph-based analysis depends on evidence from access and change events.
Recommendation — Use access control management to inventory entitlements and remove excessive or inherited access. Centralize logs to support entitlement review and relationship analysis.
NIST CSF 2.0	PR.AC — Access Control	The comparison centers on how access is governed and verified across identities and permissions.
	GV.OC — Organizational Context	Graph-based models add context to how access relationships support business operations.
Recommendation — Apply access control governance to validate entitlement decisions and constrain privilege. Align identity governance with business context before certifying access.
OWASP Non-Human Identity Top 10	NHI-01 — Secret Sprawl	Graph-based identity models help surface connected access paths and hidden credential exposure.
	NHI-02 — Overprivileged NHIs	Graph analysis is useful for spotting toxic combinations and excessive privilege.
Recommendation — Track and reduce secret sprawl to limit hidden access paths. Identify and reduce overprivileged identities using relationship-aware analysis.

Practitioner Guidance

What to verify: Before trusting any access decision, confirm whether the model can answer inheritance, transitive access, shared ownership, and cross-role overlap, not just direct entitlement ownership. If it cannot, it is still a review tool, not a graph-based control model.

Decision rule: Use a traditional review for attestation and audit sign-off, but use graph analysis for remediation prioritization, toxic combination detection, and impact analysis after role or policy changes.

What good looks like: The governance team can move from “who has this permission?” to “why does this permission exist, what else does it connect to, and what would break if we removed it?”

Practitioner takeaway: Static reviews certify access snapshots, but graph models explain access structure, and that structural view is what makes governance operational instead of merely procedural.