TL;DR: Clarity Security says 2025 marked a shift from manual identity governance toward ABAC-driven, context-aware automation, with 74,667 joiners onboarded, 113,628 movers automated, and 438,255 hours saved across customer activity. Role-based access and static lifecycle workflows are no longer enough when access must adapt to attributes, entitlements, and audit demands in real time.
At a glance
What this is: This is a year-in-review analysis of Clarity Security’s 2025 identity governance changes, centered on ABAC, lifecycle automation, and expanded visibility into privileged and non-human access.
Why it matters: It matters because IAM and IGA teams are being pushed beyond role maintenance into attribute-driven decisions, automated joiner-mover-leaver flows, and better governance of privileged and non-human access.
By the numbers:
- Clarity Security says 674 UARs were completed across its customer base in 2025.
👉 Read Clarity Security's analysis of ABAC and autonomous identity governance in 2025
Context
Identity governance breaks down when access decisions depend on static roles, manual tickets, and slow review cycles. In complex environments, those models create role bloat, delay onboarding, and leave too much privileged access sitting behind exceptions that no one wants to own.
ABAC changes the control model by making access conditional on context such as role, location, device, and entitlement relationships. For IAM and IGA teams, the real question is not whether automation is possible, but whether governance can stay explainable when decisions move from humans to policy logic.
Clarity Security frames 2025 as the year its customers moved toward autonomous identity governance, with more lifecycle work and access review activity being handled through automated workflows. The governance issue is broader than one platform feature: once access decisions become dynamic, auditability and control design have to move with them.
Key questions
Q: How should teams implement ABAC without losing governance control?
A: Implement ABAC in narrow use cases first, where the attributes driving the decision are well understood and easy to audit. Keep the policy model separate from attribute inventory, and validate that reviewers can explain each access grant in plain language before expanding to broader workloads.
Q: Why does role bloat become a problem in identity governance programmes?
A: Role bloat happens when static roles try to represent too many exceptions, business contexts, and lifecycle variations. The result is brittle access design, more manual overrides, and weaker audit clarity because teams stop trusting roles as a clean representation of real access needs.
Q: What breaks when joiner-mover-leaver workflows are mostly manual?
A: Manual workflows create delay, inconsistency, and missed revocations. Access changes arrive late, offboarding becomes dependent on ticket discipline, and audit evidence is fragmented. The result is entitlement creep and a larger attack surface because the organisation cannot prove that access changed when the business event changed.
Q: How do security teams keep privileged access visible in automated governance?
A: Keep privileged access discovery and non-human identity inventory as explicit controls, not side effects of provisioning. Dynamic policy can hide risk if the team cannot still identify Tier 0 and Tier 1 access, nested groups, and machine identities before decisions are made.
Technical breakdown
Why ABAC changes the access decision layer
Attribute-based access control, or ABAC, evaluates policy against attributes such as user role, device posture, location, and resource context at decision time. That differs from RBAC, where access is bundled into predefined roles that tend to accumulate exceptions and create role bloat. In practice, ABAC shifts governance from maintaining large role catalogs to maintaining policy logic and trustworthy attributes. The hard part is not the decision engine alone, but the integrity and freshness of the inputs that feed it. If attributes are stale, inconsistent, or poorly sourced across systems, automation simply makes bad decisions faster.
Practical implication: map which access decisions can move from role assignment to attribute policy without losing auditability.
How automated lifecycle workflows change joiner-mover-leaver governance
Joiner-mover-leaver governance becomes materially different when onboarding, transfers, and offboarding are triggered through workflow rather than manual ticket handling. Automation can reduce delay, but it also increases the need for deterministic entitlement logic, because each lifecycle event may fan out across multiple systems and nested dependencies. The article’s emphasis on linked entitlement provisioning points to a common IGA problem: one identity change often requires coordinated updates in several applications. Without that coordination, teams either over-provision to avoid outages or leave gaps that break access continuity.
Practical implication: validate that lifecycle workflows resolve dependent entitlements consistently before expanding automation scope.
Why privileged and non-human visibility still matters in an ABAC model
ABAC improves access precision, but it does not eliminate the need to know who and what holds high-risk permissions. The article’s Tier 0 to Tier 2 tagging, nested access reporting, and Azure Managed Identity visibility show that governance still depends on seeing privileged paths and non-human identities clearly. This is where context-aware access meets identity inventory discipline. If privileged access and machine identities remain hidden in nested groups or cloud entitlements, policy-based access control cannot prove whether the right subject is actually receiving the right access.
Practical implication: keep privileged access discovery and non-human identity inventory separate from the access decision logic itself.
NHI Mgmt Group analysis
ABAC is a governance model shift, not just a feature upgrade. Role-based access control was built for stability, while modern identity environments are defined by context changes, nested entitlements, and frequent lifecycle movement. Once those conditions dominate, the control problem moves from role maintenance to policy quality and attribute trust. Practitioners should treat ABAC as a governance operating model with audit consequences, not as a shortcut around IGA discipline.
Autonomous governance only works when entitlement dependencies are explicit. The article’s linked provisioning examples show that access no longer behaves as a single grant in many enterprise stacks. One identity change can require coordinated updates across multiple applications, cloud identities, and review artefacts. That makes hidden dependency mapping a core governance requirement, because automation without dependency visibility simply moves breakage from the service desk into policy execution.
Tier 0 to Tier 2 tagging remains essential even when access becomes more dynamic. Real-time policy does not remove the need to understand where the highest-risk permissions live. In fact, dynamic governance can make blind spots worse if privileged accounts and non-human identities are buried inside nested access structures. The right conclusion is not that manual control disappears, but that discovery, classification, and policy enforcement have to operate together.
Attribute-level audit trails become the proof layer for ABAC programmes. If a governance team cannot explain why access was granted, it cannot defend automated decisions to auditors or internal risk owners. Attribute-rich logging is therefore not an add-on; it is the evidentiary layer that makes automated access governable. Practitioners should view transparency as part of control design, not post-event reporting.
From our research library:
- Nearly 60% of IT leaders cite restrictive cost and complexity as a weakness of legacy identity governance, according to the 2025 State of Identity Governance Report.
- Read next: IGA Buyer's Guide
What this signals
ABAC only improves governance when the attribute sources are trustworthy. Teams should assume that automation amplifies upstream data quality issues rather than solving them. If role, device, and entitlement attributes are inconsistent across systems, access decisions become harder to defend even when the workflow is technically faster.
Identity governance is moving from review-heavy operations to decision-heavy operations. That shift changes what teams need to measure: not just how many access reviews were completed, but how explainable, timely, and dependency-aware each decision was. Programmes that still optimise for manual throughput will miss the control point that now matters most.
For practitioners
- Define where ABAC can replace RBAC Start with access paths where role bloat, frequent exceptions, or multi-role users make static roles inefficient. Keep the first wave narrow enough that policy outcomes can be reviewed and explained.
- Inventory the attributes your policies depend on Identify which sources provide role, device, location, entitlement, and lifecycle signals, then check whether those values are current and consistent across systems.
- Map dependent entitlements before automating workflows Document which downstream applications, groups, and cloud identities must change when a joiner, mover, or leaver event occurs. Use that map to prevent silent access gaps.
- Preserve privileged access discovery outside policy logic Keep Tier 0, Tier 1, and non-human identity discovery visible as a separate governance activity so dynamic access decisions do not obscure high-risk access paths.
- Make audit trails explain the access decision Ensure reviewers can see the attribute combination, entitlement dependency, and lifecycle event that caused access to be granted or removed.
Key takeaways
- ABAC changes identity governance by moving access decisions from static roles to context-aware policy, which reduces role bloat but raises the bar for attribute quality.
- Automated lifecycle workflows can remove ticket fatigue, yet they only work safely when entitlement dependencies and privileged paths are mapped with precision.
- The governance challenge in 2025 is not whether to automate, but how to keep automated access explainable, auditable, and visible across human and non-human identities.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 addresses the attack and risk surface, while NIST CSF 2.0, CIS Controls v8 and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-05 — Overprivileged NHI | Automated governance still has to surface high-risk access held by machine identities and nested entitlements. |
| Recommendation — Use NHI-05 to identify and reduce excessive permissions in cloud and directory-linked machine identities. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | The article focuses on how access permissions and entitlements are governed through attribute-based policy. |
| Recommendation — Apply PR.AA-05 to review whether entitlements are policy-driven, explainable, and consistently enforced. | ||
| CIS Controls v8 | CIS-5 — Account Management | Lifecycle automation and privileged visibility both sit inside account governance and access maintenance. |
| Recommendation — Use CIS-5 to standardise account lifecycle handling, review, and removal across identity systems. | ||
| NIST SP 800-53 Rev 5 | IA-5 — Authenticator Management | The article’s automation model still depends on controlled issuance and lifecycle of authenticators and access factors. |
| Recommendation — Apply IA-5 to govern authenticator issuance, rotation, and revocation alongside automated access workflows. | ||
Key terms
- Attribute-Based Access Control: Attribute-Based Access Control is a policy model that grants or denies access using attributes such as user role, device state, location, and application context. It replaces purely static role assignment with a decision process that can adapt to current conditions, provided the underlying attributes are trustworthy and well-governed.
- Joiner, Mover, Leaver Workflow: A joiner, mover, leaver workflow is the process that grants, updates, and removes access as a user or identity changes state. In modern programs, the same logic should extend beyond employees to service accounts and AI agents so access does not persist after need ends.
- Role Bloat: The accumulation of excess entitlements inside a role over time. It happens when temporary access, exceptions, and business-specific permissions are added to an existing role instead of being removed or separated. Role bloat weakens least privilege and makes access reviews harder to trust.
- Interaction-Level Audit Trail: A record that captures the full AI session rather than only network traffic or file events. It ties the prompt, model response, identity, and policy response together so auditors can reconstruct what happened and why the control acted the way it did.
What's in the full article
Clarity Security's full article covers the operational detail this post intentionally leaves for the source:
- Step-by-step detail on the ABAC engine and how policy decisions are evaluated in practice
- Expanded explanations of the one-click integrations and custom webhook flows
- More detail on the privileged access tagging, nested access reports, and Azure Managed Identity visibility
- The full 2025 usage totals and productivity calculations behind the hours-saved figure
Deepen your knowledge
NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.
Published by the NHIMG editorial team on June 24, 2026.
Updated on October 8, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org