It tells IAM teams that deployment success is not the same as operational success. If clinicians still experience friction, the identity model is failing at the point of use, which means governance, application integration, and workflow design need to be assessed together rather than separately.
When capability exists but the workflow still feels hard to use
The gap matters because IAM is judged where people and systems actually consume access, not where the control exists on paper. If clinicians still need workarounds, extra clicks, or repeated re-authentication, the access model may be technically deployed but operationally misaligned. That usually points to a mismatch between policy design, application integration, and frontline workflow.
For identity teams, that gap is a signal to look for friction that is being absorbed outside the IAM platform, such as manual exceptions, shared accounts, brittle federation paths, or local app-specific bypasses. A working control plane that creates routine operational pain is not fully working in practice.
The right interpretation is not that more security is always the answer. It is that the model must fit the task, the application, and the user journey. If the path to access is slower than the clinical work itself, people will route around it, and the organisation will inherit both usability debt and control debt.
What the gap says about governance and integration
It tells you the identity programme cannot be treated as a standalone technology rollout. Governance decisions, application owners, and workflow designers all shape whether access feels seamless or obstructive, so ownership has to be shared across those layers. The most common failure is assuming the identity team can “fix” a poor application journey without changing the surrounding process.
This is where the distinction between deployment success and operational success becomes important. A system can pass implementation milestones, satisfy audit checkpoints, and still fail to support the actual business flow. When that happens, the question is not whether authentication works in isolation, but whether authorization, session handling, and exception handling fit the way the application is used.
That is also why the gap is useful as a governance signal. It exposes where policy intent is not translating into usable controls, and where local teams have adapted the process to make work possible. Those adaptations deserve review because they often become the real operating model.
Why user friction becomes a security problem
When access is painful, users and support teams look for shortcuts. Those shortcuts can include password sharing, lingering sessions, overbroad entitlements, temporary exceptions that never expire, or alternate channels that bypass the intended control path. Over time, the organisation starts to protect the documented process rather than the way access is actually consumed.
For a clinical environment, that creates a direct trade-off between speed and assurance. If the IAM experience is slow or unreliable, staff will optimise for patient flow first and control integrity second. The security consequence is not just inconvenience, it is a drift toward informal access practices that are harder to monitor and revoke.
Good identity governance therefore needs to treat friction as an early warning indicator. If the user experience is poor enough to generate workarounds, the security model is already leaking value at the point of use.
Risk and Threat Considerations
When identity controls are deployed but still feel cumbersome, the primary risk is control bypass by human behaviour. Frustrated users, support teams, or integrators may adopt shortcuts that preserve productivity while weakening traceability, revocation, or least privilege.
Failure mechanism: The identity flow is technically present but operationally misfit, so users compensate with shared access, manual exceptions, stale sessions, or alternative paths that sit outside normal governance.
Impact: The organisation can end up with invisible privilege growth, weaker accountability, and a larger attack surface even though the IAM project appears complete.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
CIS Controls v8, NIST CSF 2.0 and CSA Cloud Controls Matrix set the technical controls, while ISO/IEC 27001:2022 defines the regulatory obligations.
| Framework | Control / Reference | Relevance |
|---|---|---|
| CIS Controls v8 | CIS-5 — Account Management | User-workflow friction often leads to unmanaged exceptions and shared access. |
| Recommendation — Tighten account governance where users rely on bypasses or standing exceptions. | ||
| NIST CSF 2.0 | PR.AA-05 — Authentication is enforced commensurate with risk | The gap concerns access experience versus intended control strength. |
| Recommendation — Align authentication strength and flow with the actual risk of the clinical task. | ||
| ISO/IEC 27001:2022 | A.5.15 — Access control | The issue is whether access policy works in daily operations and not just on paper. |
| Recommendation — Review access control design against real workflow use and exception patterns. | ||
| CSA Cloud Controls Matrix | IAM — Identity and Access Management | Cloud IAM governance also fails when integrated workflows create operational friction. |
| Recommendation — Validate IAM governance against the end-to-end access journey users actually follow. | ||
Practitioner Guidance
What to prioritise: Start with the highest-friction journeys, especially those tied to patient care or other time-sensitive work. A small number of broken workflows often explains most of the bypass behaviour.
What to verify: Check whether the user pain is caused by policy design, application integration, session design, approval latency, or exception handling. If the friction is downstream of IAM, the fix will not come from the identity platform alone.
Decision rule: If users need a workaround to complete routine work, treat that as a control design failure, not a training problem. If the workaround is recurring, it has probably become part of the real operating model.
Practitioner takeaway: The best IAM controls are the ones people can follow under pressure, because a secure design that users routinely avoid is already losing to the workflow.
Related resources from NHI Mgmt Group
- Why do identity teams need to separate backend IAM capability from the user-facing experience?
- What is the difference between human IAM controls and NHI governance?
- How can teams tell whether access is improving digital experience?
- How should security teams close the gap between IAM policy and actual execution?