Authentication can work perfectly while access governance still fails. The common break point is entitlement control, where provisioning, offboarding, approval, and revocation remain inconsistent across applications. That leaves organisations with central sign-in but fragmented authority over who can keep access, who can request it, and how quickly it is removed.
Where the Break Really Happens in IAM
Login is only the front door. If IAM stops at authentication, the organisation may know who signed in but still fail to govern what that identity can keep, gain, or lose over time. The operational break sits in entitlement governance, where provisioning, deprovisioning, approval workflows, and periodic review have to stay aligned across every connected application.
That gap matters because access authority is not a one-time event. A clean sign-in process can coexist with stale entitlements, orphaned access, and approval paths that differ from system to system, which makes the control plane look stronger than the actual access state.
When this problem shows up in practice, the answer often lies in lifecycle controls rather than stronger login controls. NHIMG’s Joiner-Mover-Leaver (JML) Guide frames the issue as a process problem, not an authentication problem, because access drift usually begins when joiner, mover, and leaver events are not translated into timely account changes.
Why Central Sign-In Can Hide Fragmented Authority
A central identity provider can make access feel consistent while the downstream enforcement remains fragmented. One application may honor role changes immediately, another may require manual approval, and a third may never receive the deprovisioning event at all. The result is central authentication with distributed entitlement truth.
This is why lifecycle governance needs to be treated as a separate control layer from login. Entitlement decisions depend on authoritative source data, access request routing, recertification, and revocation timing, not only on whether the user can authenticate successfully.
NHIMG’s Identity Security Programme Guide is useful here because it connects governance, RACI, and operating model decisions to the access lifecycle rather than to sign-on alone.
What Failure Looks Like in Day-to-Day Operations
Most failures are visible long before a major incident. Common symptoms include access requests being approved outside policy, leavers retaining access after offboarding, movers inheriting obsolete permissions, and exception handling becoming the normal path. Those are governance failures, even if login telemetry looks healthy.
The practical test is whether an organisation can answer three questions quickly and consistently: who should have access, who approved it, and how fast can it be removed. If any of those answers vary by application, region, or support team, the IAM programme is only partially solving the problem.
NHIMG’s Lifecycle Processes for Managing NHIs and Key Challenges and Risks both map well to this failure mode because they highlight the same control pattern: lifecycle inconsistency creates hidden access persistence.
Risk and Threat Considerations
When lifecycle governance is weak, the risk is not only excess access, it is durable excess access. A user or non-human account can remain authorised long after the business justification ends, which increases the blast radius of compromise, insider misuse, and simple operational error.
Failure mechanism: Authentication succeeds, but access changes do not propagate reliably across applications, so stale entitlements, delayed revocation, and unmanaged exceptions accumulate.
Impact: Attackers and insiders can exploit lingering permissions, and the organisation may be unable to prove timely removal of access for leavers, role changes, or temporary approvals.
NHIMG’s Top 10 NHI Issues reinforces the broader risk pattern around overprivilege, visibility gaps, and unmanaged credentials, which are exactly the conditions that make lifecycle failures persist after login has been solved.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST SP 800-53 Rev 5, CIS Controls v8 and CSA Cloud Controls Matrix set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev 5 | IA-5 — Authenticator Management | Lifecycle governance depends on controlling credentials and revocation timing. |
| AC-2 — Account Management | The question is about provisioning, offboarding, and account lifecycle control. | |
| AC-6 — Least Privilege | Broken lifecycle governance commonly leaves users with excessive standing access. | |
| Recommendation — Manage credential issuance, rotation, and revocation so access does not outlive its purpose. Automate account provisioning, modification, and removal across connected systems. Restrict permissions to the minimum necessary and remove excess rights promptly. | ||
| CIS Controls v8 | CIS-5 — Account Management | Account governance is the core failure mode when login works but access lifecycle does not. |
| Recommendation — Inventory accounts, tie them to owners, and remove stale or orphaned access quickly. | ||
| CSA Cloud Controls Matrix | IAM — Identity and Access Management | IAM lifecycle governance in cloud environments is the exact subject of the break point. |
| Recommendation — Align provisioning, review, and deprovisioning controls across cloud identity paths. | ||
Practitioner Guidance
What to prioritise: Treat entitlement governance as a separate control objective from authentication. The first thing to verify is whether provisioning, mover changes, and offboarding are driven by an authoritative source and enforced consistently in every material application.
What to verify: Check whether every access path has a clear owner, a revocation trigger, and a measurable removal SLA. If revocation depends on tickets, manual cleanup, or app-by-app memory, the control is already degraded.
Common mistake: Teams often celebrate SSO rollout and assume IAM is “done.” In reality, SSO can reduce login friction while leaving the harder governance problem untouched.
Practitioner takeaway: Strong login controls reduce one kind of risk, but lifecycle governance determines whether access remains defensible after the first sign-in.