Because excess access persists when policies are never recertified against actual use. In OCI, dormant accounts, unused permissions and unreviewed credentials can remain active long after ownership has changed, which expands the attack surface and makes privilege creep harder to reverse.
Why broad OCI policies create hidden access paths
Broad OCI policies often outlive the business context that created them. When permissions are written at a wide scope, they are easier to keep working than to safely narrow, so access accumulates across compartments, groups and automation paths. That makes the policy itself a persistence layer for privilege, especially when no one is reviewing whether the original need still exists.
The practical problem is not just that broad policy grants are large, but that they are durable. In OCI, inherited access and shared policy statements can survive ownership changes, project closures and account turnover, which means a permission that was once temporary can become effectively permanent. NHIMG’s Ultimate Guide to NHIs is useful background here because the same lifecycle failure pattern shows up in identity governance, offboarding and rotation. Broad policy also widens blast radius when an identity is misused, because one stale grant can expose more resources than the operator realises.
How stale identities turn policy drift into real identity risk
Stale identities are the force multiplier. Dormant accounts, unused credentials and unreviewed service identities make broad policy more dangerous because the access is still technically live even when the business owner has moved on. The result is privilege creep: entitlements remain attached to identities that no longer have a clear purpose, and that gap is where takeover, misuse or lateral movement becomes easier.
This is where lifecycle management matters more than policy wording alone. If you do not know which identities are still active, which are still owned, and which can still authenticate, you cannot tell whether a broad permission is actually justified or simply forgotten. NHIMG’s Top 10 NHI Issues and Guide to NHI Rotation Challenges are relevant references because they surface the same failure modes: unused access, poor ownership, weak rotation discipline and slow revocation. For OCI, the lesson is that risk rises when policy governance and identity lifecycle drift in opposite directions.
One useful data point from NHIMG’s Ultimate Guide to NHIs is that only 20% of organisations have formal processes for offboarding and revoking API keys, and even fewer have procedures for rotating them. That is a strong indicator of why stale access remains common: the control is not the grant itself, it is the follow-through.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 address the attack and risk surface, while CIS Controls v8 and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-01 — Secrets and Credential Management | Stale identities and unused credentials increase exposure when access persists beyond need. |
| NHI-03 — Lifecycle Management | The question is about dormant access and missing recertification across identity lifecycles. | |
| NHI-04 — Least Privilege and Access Governance | Broad OCI policies expand blast radius through excessive standing access. | |
| Recommendation — Inventory credentials and revoke or rotate any identity material that no longer has a current owner. Recertify identities on a fixed cadence and remove entitlements when the business need has ended. Reduce standing access to the minimum set required for the active workload or user. | ||
| CIS Controls v8 | 6 — Access Control Management | Broad policies and stale identities are access control failures that need ongoing review and removal. |
| Recommendation — Review access rights regularly and remove accounts or permissions that are no longer required. | ||
| NIST CSF 2.0 | PR.AC — Access Control | Persistent permissions and stale identities weaken access control governance and increase exposure. |
| Recommendation — Enforce least privilege and periodic access review for all active identities. | ||
Practitioner Guidance
What to verify: Check whether each OCI policy statement still maps to a current business owner, current resource set and current identity. If you cannot tie a grant to an active workflow or service, treat it as an exception candidate rather than a standing permission.
Decision rule: If an identity has not been recertified recently, prioritise revocation review before broader policy cleanup. Removing stale identities first usually reduces more risk than trying to redesign every policy at once, because dormant access is the easiest place for hidden privilege to persist.
What practitioners underestimate: Broad policy scope is often tolerated because it is operationally convenient, but convenience becomes exposure when accounts turn over and ownership changes. The harder the policy is to review, the more important it is to make identity ownership and recertification explicit.
Practitioner takeaway: Identity risk rises fastest when wide permissions and stale identities reinforce each other, so the real control objective is continuous ownership, recertification and revocation, not just writing a narrower policy.
