What breaks when IAM reviews assume access is stable long enough to certify?

Review cycles lose their value when the actor can change scope during execution or disappear before the next certification window. That creates a governance blind spot where the entitlement record looks acceptable, but the active behaviour never gets assessed. Teams need runtime evidence, not only periodic attestations.

Why This Matters for Security Teams

Certification assumes access is stable long enough to review, but non-human identities often do not behave that way. A token may exist for minutes, a workload can pivot across tools mid-execution, and an agent can complete a task before the next review window even opens. That is why periodic attestation can look clean while the actual runtime posture is unsafe. NHI Management Group’s Ultimate Guide to NHIs shows how often organisations still miss the basics of visibility, rotation, and offboarding.

The practical issue is not just short-lived access. It is that many review processes were built around human employment cycles, not autonomous workloads that can chain tools, change scope, and discard identities after use. The OWASP Non-Human Identity Top 10 highlights the risk of weak lifecycle control and over-privileged machine access, both of which undermine certification as a meaningful control. In practice, many security teams encounter the failure only after a workload has already used approved access in an unapproved way, rather than through intentional review design.

How It Works in Practice

When IAM reviews assume stable access, they certify the entitlement record instead of the runtime behaviour. That works poorly for agents, ephemeral workloads, and service accounts that only exist for a task or that expand their activity based on context. Current guidance suggests moving from static access reviews to evidence of actual use: what the identity accessed, when it accessed it, why the policy allowed it, and whether the session was revoked at completion.

Operationally, that means pairing review workflows with workload identity, short-lived credentials, and policy evaluation at request time. A system such as SPIFFE or OIDC can prove what the workload is, while policy-as-code can decide whether the requested action fits current context. For agentic systems, this aligns with emerging frameworks such as the OWASP Agentic AI Top 10, which treats autonomous tool use as a live authorization problem rather than a one-time entitlements check. It also matches NHI lifecycle guidance in the Ultimate Guide to NHIs — Key Challenges and Risks.

• Issue credentials per task, not per quarter.
• Use short TTLs and automatic revocation on task completion.
• Log runtime evidence showing the exact action, context, and policy decision.
• Review exceptions based on execution traces, not just permission lists.
• Escalate only with just-in-time approval and bounded duration.

The 52 NHI Breaches Analysis is useful here because it repeatedly shows the same pattern: access appears acceptable on paper, then breaks down in operation when identity lifecycle and privilege scope are not governed together. These controls tend to break down in high-churn CI/CD, multi-cloud, and agentic workflows because the identity can change faster than the review queue.

Common Variations and Edge Cases

Tighter runtime certification often increases operational overhead, requiring organisations to balance assurance against review speed and engineering friction. That tradeoff is especially visible where jobs are long-running, highly distributed, or delegated across teams. There is no universal standard for how often a machine identity must be re-certified, but current guidance suggests the interval should follow the credential’s actual lifetime and blast radius, not the calendar.

One edge case is a workload that is technically persistent but functionally transient, such as a controller that keeps a stable identity while spawning short-lived child processes. Another is an AI agent that retains state between tasks while its tool access changes dynamically. In those cases, a simple access recertification can miss the real risk because the danger sits in runtime delegation, not in the base account. The Ultimate Guide to NHIs and the OWASP guidance both point toward lifecycle control, but the implementation pattern still has to be adapted per environment.

In practice, teams should treat certification as one signal among several, alongside session telemetry, secret rotation status, and revocation evidence. Where those signals are missing, the review gives false comfort rather than control.

Related resources from NHI Mgmt Group

• What breaks when identity governance relies only on access reviews?
• How should security teams run access reviews for non-human identities?
• When do NHI access reviews create more value than a one-time cleanup?
• What breaks when non-human identities are managed outside the IAM operating model?