Tier drift is the gradual mismatch between an identity’s assigned access tier and its real risk or privilege level. It happens when role changes, temporary exceptions or legacy entitlements leave an account over- or under-tiered, so governance controls no longer match actual access.
What tier drift means in practice
Tier drift is not just a bookkeeping issue, it is a control mismatch. The account still exists, but its tier no longer reflects the access it actually holds, so governance decisions are being made against stale assumptions.
This usually appears after promotions, team moves, contractor changes, temporary access approvals, or legacy entitlements that were never revalidated. Over time, the tier becomes a label rather than a reliable statement of privilege.
How tier drift develops
Tier drift often starts with a justified exception. A user is granted extra access for a project, an elevated role is kept after a support issue, or an older entitlement survives a reorganisation. When those changes are not removed or re-tiered, the gap between assigned tier and real privilege widens.
It can also move in the opposite direction. A role may be downgraded on paper while inherited access, shared group membership, or indirect permissions keep the effective privilege higher than intended. The drift is gradual, which is why it is easy to miss until a review or incident exposes it.
Why tier drift matters for access governance
Tiering only works when it matches current risk. If a low-risk account keeps higher-tier access, the organisation may approve, review, or monitor it too lightly. If a high-risk account is under-tiered, it may bypass the scrutiny that should apply to sensitive access.
That mismatch weakens recertification, approval workflows, segregation of duties checks, and access reviews. It also makes policy exceptions harder to interpret, because the governance model no longer reflects the real privilege picture.
Signals and examples of tier drift
Common signals include users whose access exceeds their current job function, accounts carrying legacy group memberships, repeated temporary grants with no expiry, and tier labels that differ from what audit logs or entitlements show. Salesloft OAuth token breach is a useful reminder that drift in token and access handling can turn a supposed integration into a path to broader data access.
In practice, tier drift may show up as over-delegation, stale service access, or accounts that still carry entitlements from an old project or vendor relationship. The key question is whether the assigned tier still matches the actual authority the account can exercise.
Risk and Threat Considerations
Tier drift creates a hidden trust gap: the organisation believes an account is governed at one level, while the account’s effective privilege has moved elsewhere. That can leave sensitive access underprotected or overexposed, especially when exceptions accumulate and reviews rely on outdated tier labels.
Failure mechanism: Privilege changes are granted temporarily, inherited through groups, or left behind after role changes, then governance records are not updated to the new reality.
Impact: Access reviews become unreliable, excessive privilege persists longer than intended, and attackers or insiders can exploit the mismatch to reach data or systems that should have been restricted.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST SP 800-53 Rev 5 and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev 5 | AC-2 — Account Management | Tier drift arises when account access no longer matches current role and approval state. |
| AC-6 — Least Privilege | Tier drift often leaves accounts over-privileged relative to their intended access tier. | |
| AC-3 — Access Enforcement | Tier drift matters because enforced access should align with the organisation's intended tiering model. | |
| Recommendation — Review and adjust account entitlements whenever role or exception status changes. Reassess privileges so each account retains only the access needed for current duties. Enforce access decisions against the current tier model, not stale role assumptions. | ||
| NIST CSF 2.0 | PR.AA-04 — Access Permissions and Authorizations Managed | Tier drift is a permissions governance problem where granted access no longer matches current risk. |
| Recommendation — Continuously reconcile permissions and authorizations with the current access tier. | ||
Practitioner Guidance
Why practitioners should care: Tier drift is a governance integrity problem, not a naming problem. If the tier no longer tracks actual privilege, the access model stops supporting sound review, approval, and exception handling.
What to watch for: Look for recurring temporary access, inherited entitlements, old roles that never close out, and accounts whose effective permissions are clearly higher or lower than their assigned tier. Those are the situations where re-tiering, not just review, is needed.
Practitioner takeaway: Treat tier as a living control attribute and revalidate it whenever role, project, or exception status changes.