Adaptive identity governance for higher education NHI risk

At a glance

What this is: This blog argues that higher education’s openness is creating a growing identity security problem because access often persists beyond its justification and now spans human, machine, and AI agent identities.

Why it matters: It matters because universities need governance that preserves collaboration and academic freedom while still controlling overbroad access across students, staff, contractors, researchers, and non-human identities.

Context

Higher education identity governance becomes difficult when access is distributed across many systems, changes frequently, and must support both openness and control. The article frames the core problem as a governance gap: identities are provisioned quickly for legitimate collaboration, but they are not consistently reviewed, re-scoped, or removed when the underlying need changes.

The article also highlights that universities now manage non-human identities and AI agent access alongside students, faculty, staff, contractors, and visiting researchers. That expands the governance problem from simple joiner-mover-leaver administration into a broader lifecycle and entitlement control challenge across fragmented campus environments.

Key questions

Q: What breaks when universities leave access governance split across departments?

A: When governance is split across departments, no one can reliably answer who approved access, whether it still matches the role, or when it should be removed. That fragmentation creates access by proxy, where local convenience overrides central accountability and entitlement reviews become inconsistent, delayed, or incomplete.

Q: When should higher education institutions prioritise automated deprovisioning over manual reviews?

A: They should prioritise automated deprovisioning when roles change frequently, short-term staff are common, and access must follow authoritative records. Manual reviews cannot keep pace with turnover-heavy environments, so standing access persists after the work ends and the institution loses control of privilege duration.

Q: What are the signs that campus identity governance is failing?

A: Common warning signs include shared logins, delayed offboarding, role overlap that accumulates entitlements, and departments managing access differently from central identity teams. When leaders cannot prove who still has access to a system, governance is already lagging behind actual use.

Q: How should universities govern non-human identities without slowing collaboration?

A: Universities should govern non-human identities by tying every credential to an owner, purpose, and expiry condition. Collaboration stays intact when access is granted quickly but reviewed continuously, with automated revocation when the task or affiliation ends. The goal is not fewer collaborators, but fewer credentials that survive beyond need.

Technical breakdown

Why fragmented campus governance creates access by proxy

Universities often centralise provisioning but leave day-to-day access decisions in local departments and application teams. That creates an access by proxy model, where no single control plane can answer who has access, why they have it, or whether the entitlement still matches the role. In practice, weak role structures and departmental silos turn governance into a reconciliation exercise after the fact rather than a policy enforced at issuance and review time. This is especially problematic in environments with rapid turnover and overlapping affiliations, because access drift accumulates faster than manual oversight can correct it.

Practical implication: define one authoritative identity governance view across campus systems before local exceptions become the default.

How over-permissive lifecycle management expands identity risk

Lifecycle governance is the control point that determines whether access changes when a person’s affiliation changes. In higher education, fixed-term researchers, contractors, graduate assistants, and visiting academics often keep access beyond the task or appointment that justified it. When offboarding is manual or inconsistent, standing access persists long after operational need has ended. The same issue applies to non-human identities and automated agents when they are created for a project and then left in place. The result is not just excess entitlement, but a control failure where the institution cannot prove access was reduced or removed at the right time.

Practical implication: tie provisioning and deprovisioning to authoritative sources so access follows role changes instead of calendar drift.

Why non-human identities and shadow AI raise the governance baseline

Non-human identities in universities include automated scripts, service credentials, and AI agent accounts that act on behalf of academic and operational processes. These identities can be over-permissioned just like people, but they are harder to observe because they do not move through the institution’s normal employment lifecycle. Shadow AI compounds the problem when unsanctioned tools or agents are used outside approved governance. The technical issue is not the presence of automation itself. It is that many institutions still apply human-centric review patterns to machine actors whose access, duration, and purpose can change much faster than traditional access reviews can track.

Practical implication: govern non-human identities as first-class identities, with ownership, lifecycle control, and review logic that matches their runtime behaviour.

Threat narrative

Attacker objective: The objective is to exploit legitimate, over-retained access to reach sensitive university systems, data, or research environments without triggering perimeter defenses.

1. Entry occurs when legitimate credentials are reused or retained after a role ends, allowing an attacker or insider to sign in through an approved path rather than exploit the perimeter.
2. Credential abuse follows when the identity holds broader access than the current job requires, enabling the attacker to read systems, records, or research data that should have been out of scope.
3. Escalation happens when over-privileged access, shared accounts, or delayed offboarding lets the actor operate as an insider across additional university systems without detection.
4. Impact is the disruption of teaching, research, compliance, and institutional reputation, with the organization unable to prove access was removed when it should have been.

Breaches seen in the wild

• Scania insurance portal breach 2025: An attacker used an external user login, likely stolen by infostealer malware, to take insurance claim documents from a Scania portal.

Read our 52 NHI Breaches Analysis report for a comprehensive view of breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Adaptive identity governance is the only control model that matches higher education’s operating reality. Universities cannot secure a campus that changes constantly by relying on static entitlement assumptions. Student turnover, visiting staff, shared environments, and research collaboration require controls that re-evaluate access as context changes. The implication is that identity governance must function as a live control plane, not an administrative afterthought.

Access by proxy is a governance anti-pattern, not a convenience. When central teams provision access while departments manage it locally, accountability fragments and entitlement reviews lose their meaning. The institution may still have processes, but it does not have a reliable answer to who owns access decisions. Practitioners should treat that fragmentation as a structural control gap rather than a workflow issue.

Non-human identity governance now belongs inside the same lifecycle model as student and staff access. Automated scripts, service credentials, and AI agent accounts can persist beyond their intended purpose just as easily as human accounts can. The difference is that machine identities often escape normal HR- or SIS-driven lifecycle logic. The practitioner conclusion is clear: if the identity cannot be governed at issuance, change, and retirement, it should not be treated as safely managed.

Higher education’s risk is accumulation, not just exposure. The article points to role overlap, delayed offboarding, and overly broad access as recurring conditions that compound over time. That pattern creates identity blast radius, where one retained entitlement can unlock multiple systems, datasets, or research workflows. The governing problem is not openness itself, but the absence of adaptive controls that keep access aligned to purpose.

Adaptive lifecycle control is the practical middle ground between openness and lock-down. The sector does not need to sacrifice collaboration to reduce risk. It needs governance that can justify, scope, and remove access with enough precision to preserve academic work while preventing uncontrolled persistence. Practitioners should see adaptive governance as the mechanism that makes openness sustainable rather than merely tolerated.

What this signals

Adaptive identity governance is becoming the practical way to preserve academic openness without accepting indefinite access persistence. The governance test is no longer whether a university can provision quickly, but whether it can justify, adjust, and remove access across people, systems, and non-human identities as conditions change.

Higher education programmes should treat non-human identities and shadow AI as part of the same control surface as student and staff access. If the institution cannot see where access lives, who owns it, and when it expires, the review process is already behind the risk.

The real programme failure is not lack of policy language but lack of lifecycle execution. Universities need access decisions to follow authoritative source records, because manual exception handling is too slow for environments defined by turnover, collaboration, and distributed governance.

For practitioners

• Centralise identity visibility Create one authoritative view of students, staff, contractors, collaborators, and machine identities so access can be reviewed against actual entitlements instead of departmental assumptions.
• Automate lifecycle changes from authoritative sources Tie provisioning, role updates, and deprovisioning to systems such as student information and HR records so access changes when affiliations change.
• Enforce least privilege on campus roles Use role-based and policy-driven governance to keep access scoped to the minimum needed for teaching, research, administration, and collaboration.
• Bring non-human identities into the same governance process Assign ownership, lifecycle rules, and review points to scripts, service credentials, and AI agent accounts so they do not remain outside the institution’s control model.
• Treat shadow AI as an access governance issue Monitor unsanctioned AI tool use and document movement so sensitive information is not exposed through unmanaged workflows or unmanaged agent access.

Key takeaways

• Higher education identity risk grows when access outlives the role or project that justified it, especially in fragmented campus environments.
• The article ties that risk to common conditions such as shared accounts, delayed offboarding, overlapping roles, and unmanaged non-human identities.
• Universities reduce the problem by linking access decisions to authoritative lifecycle sources and treating identity governance as an operating control, not an administrative back-office task.

Key terms

• Intelligent Identity Governance: A governance model that uses automation, policy, and analytics to manage identity access with measurable operational outcomes. In practice, it is IGA designed to reduce manual effort, improve evidence quality, and keep access aligned to business state as identities change.
• Access By Proxy: Access by proxy is a governance pattern where one team approves access but another team or application actually maintains it. This creates drift between authorization and enforcement, which makes it harder to prove who has access, why they have it, and whether it should still exist.
• Identity Blast Radius: The amount of damage a compromised identity can cause across systems, data, and infrastructure. In NHI environments, it is shaped by permissions, network reach, and administrative capability rather than by the credential alone. Reducing blast radius is a containment strategy that limits lateral movement and data exposure.
• Shadow AI: AI agents, copilots, or connected tools operating without full visibility or governance from security teams. Shadow AI becomes an identity problem when those systems authenticate with unmanaged tokens, service accounts, or OAuth apps that can reach production resources.

Deepen your knowledge

NHI governance, identity lifecycle management, and machine identity security are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.