TL;DR: Clarity Security finds that conditional trust models built around periodic reviews and human-centric access workflows are no longer keeping pace with service accounts, API keys, OAuth tokens and AI agents, while up to 71% of breaches are now attributed to compromised credentials. Identity governance has moved from a review problem to a runtime control problem.
At a glance
What this is: NHI Mgmt Group's analysis, drawing on Clarity Security's blog post: Adaptive trust is the next stage in identity governance because conditional trust no longer covers the full identity estate or the speed of modern access change.
Why it matters: This matters because IAM, IGA and PAM teams must govern human and non-human access on a continuous basis, not only through periodic certification cycles.
By the numbers:
- Up to 71% of breaches are now attributed to compromised credentials and identity-based attacks, according to Clarity Security.
👉 Read Clarity Security's analysis of adaptive trust and conditional identity governance
Context
Adaptive trust is an identity governance model that evaluates access continuously rather than waiting for scheduled review cycles. The article argues that the older conditional trust model assumed access could be granted and later checked, but that assumption breaks once non-human identities and fast-changing permissions dominate the environment.
The problem is not just volume. Human identities, contractors, third parties, service accounts, API keys, OAuth tokens and AI agents all sit in the same access graph, yet many governance programmes still treat them as different operational problems. That leaves IAM and IGA teams with a model that cannot see risk at the speed it now appears.
Clarity Security frames this as a structural limit, not a tuning issue. The article’s core claim is that access must be assessed, triaged and remediated in motion if identity governance is to remain effective.
Key questions
Q: Where does conditional trust fail in modern identity governance?
A: Conditional trust fails when the environment changes faster than periodic reviews can detect and fix access drift. It also fails when the governance model assumes human employment patterns, while the real access surface is dominated by non-human identities, third parties and machine credentials that do not fit HR-based review logic.
Q: Why do compromised credentials create such a large breach risk in identity-led environments?
A: Because a stolen credential often appears legitimate to downstream systems, which means the attacker can blend into normal access flows. Once inside, they can escalate privilege, reuse sessions, and move laterally without tripping perimeter controls. In cloud and SaaS environments, the compromise of one identity can quickly become an enterprise-wide access problem.
Q: What are the signs that identity governance is not working in practice?
A: Common warning signs are repeated access workarounds, ignored approval workflows, super admins holding too much power, and teams bypassing the process because it is too slow or hard to use. If access reviews are always behind, permissions stay stale, and IT has to chase owners for answers, governance is operating more as paperwork than control.
Q: How should teams move from periodic access reviews to continuous governance?
A: Start by identifying the identity events that already occur in your environment, such as joiner, mover, leaver, entitlement change, and ownership change events. Then connect those signals to policy-driven workflows so routine decisions happen automatically and only risky exceptions reach human reviewers. The aim is fewer batch reviews and faster control action.
Technical breakdown
Why conditional trust breaks under continuous identity change
Conditional trust was built around the idea that access can be reviewed after it is granted. That works only when the identity estate is relatively stable and the access relationship is easy to inspect at a later date. Once contractors, service accounts, API keys and AI agents are in scope, the delay between grant and review becomes the control gap. A periodic cycle can confirm what was true last quarter, but it cannot prevent misuse in the interval between checks. That is why the article positions access governance as a runtime problem, not a campaign problem.
Practical implication: treat review cadence as evidence collection, not as the primary protection for active access.
How adaptive trust changes the identity governance workflow
Adaptive trust connects assessment directly to remediation. Instead of producing a list of findings for a separate team to chase, the model pushes the decision and the fix into the same workflow. The article describes a maturity path from human-in-the-loop review, to human-in-the-middle automation for low-risk actions, to full autonomy for well-understood cases. That progression matters because it changes governance from a retrospective certification process into an operational control loop. The control is not only whether access exists, but whether the system can act on risk while the access is still live.
Practical implication: design workflows where risk detection can trigger revocation or triage without a separate ticketing handoff.
Why non-human identities are central to the trust model shift
The article makes clear that non-human identities are not a side category. Service accounts, API keys, OAuth tokens and AI agents now represent the majority of identities in many environments, yet they often sit outside the onboarding, ownership and recertification patterns used for employees. That creates a governance blind spot because these identities do not map cleanly to HR records, manager approvals or traditional access review logic. Once machine identities become the primary access path, a human-centric governance model loses coverage even if its controls still function exactly as designed.
Practical implication: bring machine identities into the same inventory, scoping and lifecycle governance that you apply to human access.
Breaches seen in the wild
- Codefinger S3 ransomware 2025: Codefinger used victims' compromised AWS keys to re-encrypt S3 buckets with SSE-C, set 7-day deletion and demanded ransom for the key.
- Hugging Face Spaces breach 2024: Unauthorised access to Hugging Face Spaces may have exposed secrets users stored for AI apps; tokens were revoked and org tokens removed.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 150+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Conditional trust is now a scope problem, not just a cadence problem. The model assumed the governed subject was mostly a person with a stable role, manager and employment relationship. That assumption fails when service accounts, API keys, OAuth tokens and AI agents dominate the access graph. The implication is that identity governance must be re-centred on the full identity estate, not on human review cycles alone.
Adaptive trust names the right control shift: from certification to runtime decisioning. Periodic access reviews can still support compliance, but they cannot be the control that prevents misuse in a fast-moving environment. The field needs to recognise that assessment without immediate remediation is informational, not protective. Practitioners should judge governance by how quickly risk becomes action, not by how complete a review campaign looks on paper.
Non-human identities expose the weakness of HR-led governance assumptions. A service account does not join, move or leave like an employee, so the familiar joiner-mover-leaver model loses its natural triggers. This is a governance premise failure, not an implementation bug. The practical conclusion is that ownership, inventory and lifecycle controls have to be designed for identities that do not exist in HR workflows.
Just-in-time access becomes the end state when standing access no longer scales. The article is right to treat standing permissions as the residue of an older model. When access can be evaluated continuously and removed on demand, the question shifts from whether a credential can be reviewed to whether it needs to exist at all. The programme implication is that privilege should be issued for purpose, not preserved for convenience.
Identity security and cybersecurity posture are converging into the same operating problem. If the organisation cannot see who or what has access, it cannot credibly claim to manage overall cyber risk. That makes identity governance a board-level control plane rather than a back-office administration task. Security leaders should interpret posture metrics through the lens of access governance maturity, because the two are now materially linked.
From our research library:
- 80% of identity breaches involved compromised non-human identities such as service accounts and API keys, according to the Ultimate Guide to NHIs.
- Read next: Identity Threat Detection and Response (ITDR) Guide
What this signals
Adaptive trust is the named concept that matters here: it describes an access model where governance decisions happen continuously, not in batches. For identity teams, that means the control question shifts from “was this access reviewed?” to “can this access be corrected while it is still live?”
Periodic access reviews still have value, but they cannot be the primary protection once the estate includes service accounts, API keys and AI agents that may change state faster than a review cycle can observe. The practical signal is whether your programme can detect, decide and remediate within the same operational loop.
Access governance for non-human identities is becoming the deciding layer in cyber posture. According to the Ultimate Guide to NHIs, 80% of identity breaches involved compromised non-human identities such as service accounts and API keys, which makes inventory, ownership and task-scoped access the controls to watch.
For practitioners
- Inventory every identity type in one governance model Map human users, contractors, service accounts, API keys, OAuth tokens and AI agents into a single authoritative inventory so access can be governed as one estate.
- Separate review evidence from remediation execution Use access reviews to confirm the state of access, then route identified gaps into the same workflow that can revoke, scope down or triage the risk.
- Define lifecycle ownership for non-human identities Assign explicit owners for creation, change, monitoring and retirement of service accounts and other machine identities because they will not appear in HR-driven governance flows.
- Reduce standing privilege where access is task-bound Replace persistent access with task-scoped issuance wherever the entitlement is predictable enough to support just-in-time provisioning and immediate revocation.
Key takeaways
- Conditional trust no longer covers the identities and access patterns that dominate modern environments, especially non-human accounts and machine credentials.
- The important shift is operational, not cosmetic: identity controls now need to detect and act on risk while access is still in use.
- Organisations that keep treating reviews as the main control will continue to find problems after exposure, not before it.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 and MITRE ATT&CK address the attack and risk surface, while NIST CSF 2.0 sets the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-01 — Improper Offboarding | The article stresses that service accounts and third-party identities outlive the governance process. |
| NHI-05 — Overprivileged NHI | Conditional trust leaves standing permissions in place across machine identities and service accounts. | |
| NHI-07 — Long-Lived Secrets | The article explicitly cites API keys and tokens that persist beyond their safe operating window. | |
| Recommendation — Track every non-human identity through retirement and revoke access when its business purpose ends. Reduce standing access for non-human identities and scope entitlements to task-level need. Inventory and shorten the lifetime of secrets that remain valid outside their intended use window. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | The post is fundamentally about governing entitlements continuously across identity types. |
| Recommendation — Continuously validate entitlements and remove access that no longer matches current need. | ||
| MITRE ATT&CK | TA0006 — Credential Access | The article links identity compromise and compromised credentials to breach outcomes. |
| Recommendation — Prioritise monitoring and containment of credential access paths used by both people and machine identities. | ||
Key terms
- Continuous Adaptive Trust: Continuous adaptive trust is a runtime access model that adjusts permissions as an agent behaves. Access is time-bound, purpose-bound, and context-aware, then reduced or revoked when actions drift from expected intent. It is a stronger fit for agents than static entitlements alone.
- Conditional Trust: An identity model where access is granted and reviewed through scheduled governance processes after trust has already been established. It is useful for compliance, but it can leave gaps when attackers move faster than review cycles or when machine identities do not fit human lifecycle assumptions.
- Non-Human Identity (NHI): A digital identity assigned to a non-human entity such as a software application, service account, API key, bot, machine, or AI agent that enables it to authenticate and interact with systems without direct human involvement. NHIs now outnumber human identities in most enterprises by 25 to 50 times.
- Just-in-Time Provisioning: Just-in-time provisioning creates an account or entitlement at the moment it is needed, then removes it later. It reduces standing access duration, but it still relies on a static identity or role existing during the access window, which leaves room for misuse if revocation lags.
What's in the full article
Clarity Security's full article covers the operational detail this post intentionally leaves for the source:
- The full staged model of inherent trust, conditional trust and adaptive trust across identity types
- The maturity path from human-in-the-loop to human-in-the-middle to full autonomy for remediation
- The three structural blockers to continuous identity governance: tooling, governance scope and remediation disconnect
- The complete explanation of how just-in-time provisioning fits the adaptive trust model
Deepen your knowledge
NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.
Published by the NHIMG editorial team on June 27, 2026.
Updated on October 7, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org