Request-to-Entitlement Drift is the gap that grows between what access was approved and what a user, service, or AI agent actually has over time. In IAM and NHI governance, it occurs when roles, privileges, tokens, or entitlements accumulate beyond the original business request, creating excess access and control risk.
How Request-to-Entitlement Drift Happens
Request-to-entitlement drift begins when access is approved for a narrow purpose, but the actual permission set keeps expanding through role changes, inherited group membership, delegated grants, temporary exceptions, or reused credentials that never get cleaned up.
This is not just a paperwork problem. The original request may still be valid, yet the live entitlement state can quietly diverge from it, especially in systems with layered roles, many approvers, and long-lived access paths.
In practice, the drift often shows up in IAM and NHI environments as privilege accumulation, unused entitlements, stale tokens, or service permissions that outlast the business need that justified them.
Why It Matters for Access Governance
Drift weakens the link between business approval and operational reality. Once that link breaks, access reviews become less trustworthy because reviewers are no longer judging a clean request-to-access trail, but a changed state that may have grown through several unrelated decisions.
The result is often excessive access, poor accountability, and harder revocation. When organisations cannot easily show why a user, service, or AI agent still has a privilege, they also struggle to prove that the privilege is necessary.
That is why access governance has to treat the approved request as a starting point, not a permanent entitlement boundary. The governance problem is not only who asked for access, but whether the live access still matches the original justification.
Common Drift Patterns in People, Services, and Agents
Request-to-Entitlement Drift looks different across populations, but the failure shape is similar. For people, it often comes from promotion paths, project transfers, emergency grants, and role creep. For services and NHI, it often comes from tokens, secrets, or API permissions that remain active after the integration changes.
For AI agents, the same pattern appears when task scope expands, tool access accumulates, or a delegated permission is reused for broader actions than originally approved. A useful way to understand the pattern is to compare the live access model with the original request and ask what changed in between.
The strongest control signal is not the existence of approval, but the persistence of a clear, reviewable relationship between the request, the entitlement, and the current business need. IAM and IGA Basics is a useful reference point for how request, provisioning, and access governance fit together.
How to Reduce and Detect Drift
Reducing drift depends on closing the loop between request, provisioning, review, and removal. That means access should be re-checked against current purpose, not only against historic approval, and entitlement ownership should remain visible throughout the lifecycle.
Detection works best when organisations compare approved requests with actual effective permissions, not just with assigned roles in a ticketing system. It also helps to watch for entitlement growth that comes from exceptions, nested groups, role reuse, or stale access that never receives a clean recertification decision.
For non-human access, lifecycle discipline matters even more because secrets and tokens can preserve access long after the original workflow has changed. The NHI Lifecycle Management Guide and the Access Reviews and Certification Guide both reinforce that drift must be found and removed deliberately, not assumed away.
Risk and Threat Considerations
Request-to-Entitlement Drift creates hidden excess privilege, which increases the blast radius of compromise and makes legitimate misuse harder to spot. The more the live entitlement diverges from the approved request, the easier it becomes for an attacker or insider to retain access that nobody thinks they still have.
Failure mechanism: Access grows through role creep, exception stacking, token reuse, or stale entitlements, so the system retains more authority than the business case originally justified.
Impact: Excess access can enable data exposure, privilege abuse, lateral movement, and failed revocation, especially when drift affects high-value accounts, service identities, or agent permissions.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST SP 800-53 Rev 5 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev 5 | AC-2 — Account Management | Request-to-entitlement drift is governed by account and entitlement lifecycle control. |
| AC-6 — Least Privilege | Drift commonly produces excess permissions beyond the approved request. | |
| IA-5 — Authenticator Management | Drift can persist through long-lived credentials, tokens, and other authenticators. | |
| Recommendation — Review and remove access when it no longer matches the current business need. Limit effective access to the minimum privileges needed for the approved task. Rotate and retire authenticators when access purpose or ownership changes. | ||
| CIS Controls v8 | CIS-5 — Account Management | The term describes account and entitlement growth that account management must control. |
| Recommendation — Track account lifecycle and remove unneeded access promptly. | ||
Practitioner Guidance
Governance implication: Treat the approved request as a control baseline that must be reconciled against live entitlement state over time. If the effective access no longer matches the business justification, the entitlement should be revalidated or removed.
What to watch for: Pay special attention to accounts with repeated exceptions, inherited access, and long-lived credentials, because those are the places where drift tends to accumulate fastest and stay hidden the longest.
Practitioner takeaway: The core question is not whether access was once approved, but whether the current entitlement can still be defended as necessary.