TL;DR: Clarity Security says customers reclaimed 438,255 manual work hours in 2025 by automating 74,667 joiners, 113,628 movers, 6,252 leavers and 10.6 million review items, showing that manual identity governance still absorbs massive operational capacity. The governance problem is not just volume, but whether access decisions can keep pace with changing attributes, entitlements and lifecycle events.
At a glance
What this is: This is Clarity Security’s 2025 year-in-review on ABAC, lifecycle automation and identity governance, with the central finding that manual reviews and provisioning still consume substantial operational effort.
Why it matters: It matters because IAM, IGA and PAM teams have to govern both human and non-human access as context changes, and static role models no longer keep pace with modern entitlement sprawl.
👉 Read Clarity Security's year-in-review on ABAC and autonomous identity governance
Context
Identity governance fails when access decisions are locked to static roles instead of the context that actually changes risk. In practice, that means joiner, mover, leaver activity and access reviews can drift into manual backlog even when the underlying business process is changing in real time. The article frames ABAC as the response to that gap, not as a standalone feature.
For IAM and IGA teams, the core issue is lifecycle control at the moment access changes, not after the fact. The article also brings non-human identity visibility into scope through Azure managed identity support, which shows that governance problems are not limited to employee access.
The article’s central claim is that autonomous governance reduces ticket handling, role maintenance and review fatigue by shifting decisions to attribute-level context. That is a typical pain point for mature identity programmes, but the article presents it with unusually clear operational metrics.
Key questions
Q: What breaks when identity governance processes rely too heavily on manual reviews and assessments?
A: Manual governance breaks down when access volumes grow faster than review capacity. Teams miss toxic combinations, delayed deprovisioning, and inconsistent policy enforcement across systems. That creates audit findings, weak accountability, and higher risk of inappropriate access lingering after role changes, project completion, or application migrations.
Q: Why does attribute-based access control reduce risk in cloud identity management?
A: ABAC reduces risk because access decisions are made from current attributes rather than static, long-lived grants. When a user changes teams, updating the directory attribute updates access at the next sign-in without manual permission rewrites. That limits stale access, reduces overprovisioning, and helps shrink the attack surface created by broad AWS permissions.
Q: How do security teams know if lifecycle automation is actually working?
A: Measure removal completeness, not just provisioning speed. If leaver events are consistently cleared from roles, licenses, and adjacent app access without manual recovery, the lifecycle process is doing real control work. If audit evidence is reconstructed after the fact, the programme is still too dependent on people.
Q: Should non-human identities be included in access reviews?
A: Yes. Non-human identities can hold persistent access, reach sensitive systems, and outlive the business purpose that created them. If they are excluded from review, organizations leave a major blind spot in governance. Service accounts, API keys, tokens, and certificates should be reviewed with the same ownership and risk logic used for human users.
Technical breakdown
How ABAC changes entitlement decisions
Attribute-based access control evaluates context at request time instead of relying only on a prebuilt role. In the article’s framing, attributes such as role, location and device can be used to grant or revoke access dynamically, which is meant to reduce role bloat and the maintenance burden that comes with static RBAC models. This is especially relevant where users move between functions or need different access in different contexts. The architectural shift is from coarse, durable role assignment to policy-driven entitlement decisions that can change as the business changes.
Practical implication: model access around attributes and policy conditions so entitlement decisions can be made at the point of need.
Why lifecycle automation changes joiner-mover-leaver governance
Lifecycle automation is the operational layer that turns governance policy into onboarding, offboarding and role-change actions. The article treats joiners, movers and leavers as a single workflow problem, with automation reducing the lag between a lifecycle event and the resulting access change. That matters because the most common identity failures occur when access outlives the business condition that justified it. In this model, the workflow is not just administrative convenience; it is the control surface for keeping access aligned to current job state.
Practical implication: connect lifecycle events directly to entitlement changes so provisioning and revocation do not depend on manual ticket handling.
What audit-ready attribute trails change for reviewers
Attribute-level audit trails provide the decision context behind access approval or revocation. Rather than forcing reviewers to infer why a permission exists from a role name, the article says the system can show the attributes that justified the decision, including supporting signals such as last login and termination dates in the review view. That changes review quality because certification becomes evidence-led instead of label-led. For governance teams, the architectural point is that reviewability depends on preserving the decision inputs, not merely recording the final approval.
Practical implication: retain decision attributes and reviewer evidence so certification can be explained and defended later.
NHI Mgmt Group analysis
ABAC is becoming a governance control, not just an access model. The article is not really about replacing one provisioning style with another; it is about moving identity governance closer to the decision point. When access depends on role, location, device or lifecycle state, static roles become a lagging abstraction. Practitioners should treat ABAC as a control-plane change that reduces the gap between business context and authorization outcome.
Manual identity governance now fails on throughput before it fails on policy. The reported scale, 74,667 joiners, 113,628 movers, 6,252 leavers and 10.6 million review items, shows that the limiting factor is often human handling capacity rather than policy intent. That is a governance design problem, not just an operations problem. The implication is that programmes relying on ticket queues and spreadsheet-driven review cycles are already behind the pace of entitlement change.
Role bloat is the symptom; lifecycle drift is the deeper failure. RBAC is not the only issue here. The article shows that access becomes hard to govern when changes in employment state, device posture or location are not reflected quickly enough in entitlement decisions. The practical conclusion is that lifecycle governance has to become context-aware if the identity programme is to stay credible.
Non-human identity visibility now belongs in the same governance conversation as employee access. The article’s Azure managed identity support is important because it shows that identity governance cannot stop at human accounts. Workload and service identity entitlements create the same audit and revocation burdens when they are nested, inherited or left implicit. Teams should stop treating NHI governance as a separate track from IGA.
Autonomous governance only matters if it shortens the decision path, not just the workflow queue. The article’s strongest contribution is the idea that automation should reduce both manual maintenance and review friction. That matters because governance programmes often automate the form but preserve the same slow decision chain. The implication for practitioners is to measure whether decision latency, not only ticket volume, is actually falling.
What this signals
ABAC shifts the governance question from who belongs to a role to what conditions justify access now. That matters because modern identity programmes fail when role assignment becomes a proxy for current business context. Once entitlement decisions are evaluated at issuance time, policy quality becomes more important than role inventory size.
Lifecycle automation exposes how much of identity governance is still manual work in disguise. Joiner, mover and leaver flows only become meaningful when the access change follows the event without human delay. The programme signal for practitioners is simple: if the workflow cannot keep pace with change, certification and provisioning are already decoupled.
Non-human identities are part of the same governance fabric. The article’s mention of Azure managed identities is a reminder that workload access, inherited entitlements and nested permissions need the same inventory discipline as human accounts. Treating NHI as an adjacent problem leaves audit gaps in exactly the places automation is meant to close.
For practitioners
- Implement attribute-driven authorization policies Map access decisions to attributes such as role, location and device instead of relying only on static role membership. Use those attributes to drive both provisioning and revocation.
- Automate joiner-mover-leaver workflows Tie onboarding, role change and offboarding directly to identity events so access changes happen when the business condition changes, not after manual review.
- Add decision context to access reviews Show reviewers the data points that justified access, including last login and termination dates, so certification decisions are evidence-based rather than role-label-based.
- Track non-human identities alongside user access Bring managed identities, nested entitlements and inherited roles into the same governance inventory you use for human accounts so blind spots do not accumulate outside the review process.
- Measure governance by decision latency Compare the time between a lifecycle event and the actual access change, then use that metric to identify where manual handling is still overriding automation.
Key takeaways
- Manual identity governance remains a scale problem because access change, review and revocation still consume large amounts of human effort.
- The article’s figures show that lifecycle automation is most valuable when it reduces the delay between a business event and the corresponding entitlement change.
- ABAC is framed here as a governance control because it ties access decisions to current context rather than to fixed role structures.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 addresses the attack and risk surface, while NIST CSF 2.0, NIST SP 800-53 Rev 5 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-05 — Overprivileged NHI | Static role sprawl and inherited access create over-privilege patterns across human and non-human identities. |
| NHI-08 — Environment Isolation | The article's NHI visibility and nested access themes touch isolation boundaries across identities and environments. | |
| Recommendation — Reduce role bloat by reviewing whether each entitlement still maps to a current business condition. Separate workload and human access paths so nested permissions do not blur governance boundaries. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | The core problem is governing access permissions as context changes across the identity lifecycle. |
| Recommendation — Continuously validate entitlements against current attributes, lifecycle state and review evidence. | ||
| NIST SP 800-53 Rev 5 | AC-6 — Least Privilege | ABAC and lifecycle automation are both mechanisms for constraining access to what is currently needed. |
| Recommendation — Use least privilege to remove access that no longer matches the user's role, context or task. | ||
| CIS Controls v8 | CIS-5 — Account Management | Joiner-mover-leaver automation and review discipline are direct account management concerns. |
| Recommendation — Standardise account lifecycle handling so access changes are not dependent on manual ticket resolution. | ||
Key terms
- Attribute-Based Access Control: Attribute-Based Access Control is a policy model that grants or denies access using attributes such as user role, device state, location, and application context. It replaces purely static role assignment with a decision process that can adapt to current conditions, provided the underlying attributes are trustworthy and well-governed.
- Joiner Mover Leaver: Joiner Mover Leaver is the identity lifecycle process for creating, changing, and removing access as people enter, change roles, or leave an organization. It governs provisioning, modification, and deprovisioning across systems, ensuring access matches current job needs and reducing orphaned accounts, privilege creep, and residual access risk.
- Access Review: A formal process for confirming whether access is still needed and justified. In IAM programs, the review becomes an evidence-bearing control when decisions are recorded, scoped correctly, and traceable to the right reviewer, application owner, or auditor.
- Autonomy Governance: The set of controls that determine whether an automated system can act, how its actions are approved, and how those actions are explained and audited. In SOC automation, it matters because response workflows may trigger identity, containment, or remediation steps that need clear accountability.
What's in the full article
Clarity Security's full article covers the operational detail this post intentionally leaves for the source:
- The full year-in-review breakdown of joiner, mover, leaver and review automation metrics.
- Product-specific descriptions of the ABAC engine and its lifecycle workflow changes.
- Expanded details on integrations, connectors and webhook-driven workflow triggers.
- The vendor's own framing of how audit trails and review UX changed for customers.
Deepen your knowledge
NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.
Published by the NHIMG editorial team on May 30, 2026.
Updated on October 7, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org