TL;DR: Regulated organisations can strengthen access governance, compliance traceability, and implementation speed in hybrid environments, while reducing orphaned and overprivileged accounts and supporting digital sovereignty, according to Omada Identity, which says its deeper collaboration with adesso is aimed at this outcome. The practical shift is that identity control is now a sovereignty requirement, not just an administrative function.
At a glance
What this is: This is a partner announcement about Omada Identity and adesso deepening their cooperation around access governance for digital sovereignty, with the core finding that identity control is being framed as a sovereignty requirement for regulated organisations.
Why it matters: It matters because IAM, IGA, PAM, and lifecycle teams are being asked to prove control, traceability, and entitlement discipline in hybrid environments where compliance and resilience now depend on governed access.
Context
Access governance becomes a sovereignty issue when organisations need provable control over who can reach systems, data, and applications across hybrid estates. In that framing, IAM is no longer just about administration or user provisioning. It is about documentable control, auditability, and the ability to sustain business operations under regulatory pressure.
The article positions adesso and Omada's deeper collaboration as a response to that operating reality in regulated sectors and the public sector. The practical message for identity programmes is that implementation capability, process design, and compliance evidence now matter together, especially where orphaned accounts, overprivilege, and cloud and AI rollouts increase the cost of weak governance.
Key questions
Q: How should IAM teams implement access governance for digital sovereignty?
A: They should treat access governance as a control objective that must produce traceable, auditable entitlement decisions across hybrid environments. That means aligning provisioning, approval, and revocation with business ownership, regulatory evidence, and offboarding discipline. If access cannot be explained or withdrawn cleanly, sovereignty is not being enforced in practice.
Q: Why do orphaned and overprivileged accounts undermine compliance and resilience?
A: They extend access beyond business need, which enlarges blast radius and weakens the credibility of control evidence. Orphaned accounts show lifecycle failure, while overprivileged accounts show scope failure. Together they indicate that entitlement governance is not keeping pace with organisational change, especially in hybrid estates.
Q: What are the signs that access governance is too weak for regulated environments?
A: Common signs include incomplete offboarding, no clear owner for shared access, excessive manual exceptions, and entitlement reviews that do not change the underlying access model. If approvals exist but overprivilege persists, the process is documenting risk rather than reducing it.
Q: Should organisations prioritise identity governance before expanding agentic AI?
A: Yes. Organisations should establish ownership, least privilege, monitoring, and revocation for machine identities before broadening agentic AI use. Without those controls, each new agent can multiply blast radius and create shadow access that is hard to unwind after an incident.
Technical breakdown
Why access governance becomes a sovereignty control
Access governance is the set of processes that decide who gets access, when access should be removed, and how those decisions are recorded. In this article's framing, those controls support digital sovereignty because an organisation cannot claim real control if it cannot explain, evidence, and justify identity decisions across systems and jurisdictions. That shifts identity management from operational convenience to governance infrastructure. For regulated enterprises, the point is not only access approval, but the ability to demonstrate durable control over access outcomes.
Practical implication: Treat access governance as a sovereignty control plane, not a back-office administration function.
Why orphaned and overprivileged accounts remain the core risk
Orphaned accounts persist after a user, contractor, or partner no longer needs access. Overprivileged accounts carry more access than the task requires, which increases blast radius when credentials or approvals are misused. The article ties both issues to identity governance because they represent control failure over entitlement lifecycle, not just poor housekeeping. In hybrid environments, these risks grow when HR, IT, and business processes are not aligned and when offboarding does not reliably close the loop.
Practical implication: Govern joiner-mover-leaver processes and entitlement reviews as risk controls, not as routine service tasks.
How identity foundations support cloud and AI initiatives
Cloud and AI programmes fail faster when access design is vague, slow, or untraceable. A strong identity foundation gives those initiatives a governed path for provisioning, approval, and revocation, which matters when teams need speed without losing oversight. The article's emphasis is not on AI as a special category of access, but on the need for a controlled identity base that can absorb new workloads without multiplying exceptions. That is why time-to-value and governance are linked rather than opposed.
Practical implication: Embed identity governance before scaling cloud or AI programmes so access decisions stay reviewable and revocable.
NHI Mgmt Group analysis
Sovereignty now depends on identity control, not just policy language. The article reflects a broader shift in regulated environments: if access cannot be traced, explained, and audited, sovereignty is only rhetorical. That makes IAM and IGA part of operating model design, not an add-on control. Practitioners should treat identity governance as evidence-producing infrastructure for control and accountability.
Access governance has become the practical boundary between resilience and entitlement sprawl. Orphaned and overprivileged accounts are not just hygiene defects. They are indicators that lifecycle governance is disconnected from real business change, which creates avoidable exposure in hybrid estates. The implication is that governance must be measured by entitlement accuracy, not by process volume.
Cloud and AI adoption amplify the cost of weak identity foundations. When new workloads scale faster than approval and revocation processes, identity becomes the constraining control point. The article's message is that time-to-value improves when identity governance is designed as a prerequisite for adoption rather than a clean-up step afterwards. Practitioners should align programme sequencing with control readiness.
Digital sovereignty demands a named concept: access provenance discipline. In regulated enterprises, every entitlement should be attributable, justified, and revocable across its lifecycle. That concept matters because sovereignty breaks down when access exists but its origin, owner, and expiry are unclear. The practitioner takeaway is to make provenance part of every access decision.
Partnership models will increasingly be judged by governance depth, not implementation speed alone. The article signals that buyers in public sector and critical sectors want solution delivery paired with process discipline and compliance traceability. That changes evaluation criteria for IAM programmes and raises the bar for what counts as implementation success. Practitioners should assess whether partners can sustain governance over time, not only deploy tooling.
From our research library:
- 69% of security leaders agree identity management must fundamentally shift to address agentic AI systems, according to the 2026 Infrastructure Identity Survey.
- Read next: Ultimate Guide to NHIs — Regulatory and Audit Perspectives
What this signals
Access provenance discipline: regulated IAM programmes should be evaluated by whether every entitlement has a clear owner, purpose, and removal path. That is what turns sovereignty from a policy statement into an operational property, especially when access spans cloud, partner, and internal systems.
The programme signal here is sequencing. Cloud and AI adoption should not outrun identity governance maturity, because provisioning speed without revocation discipline only increases entitlement drift. Teams that want faster delivery need stronger lifecycle control first, not after the fact.
For practitioners
- Define access governance as a sovereignty requirement Map access approval, evidence capture, and revocation workflows to the specific sovereignty and compliance objectives your programme must support. Use those requirements to drive architecture decisions, not just service desk procedures.
- Clean up orphaned access paths Identify accounts, roles, and partner entitlements that survive after the business need has ended, then tie each to an accountable owner and a removal date.
- Reduce overprivilege at entitlement design time Review high-risk roles and application permissions for scope creep, especially where hybrid operations or delegated administration have widened access beyond task need.
- Sequence cloud and AI programmes behind identity readiness Set minimum access governance checkpoints before expanding cloud or AI initiatives, including entitlement traceability, approval evidence, and offboarding controls.
Key takeaways
- The article frames access governance as part of digital sovereignty, which raises IAM from administration to control assurance.
- Orphaned and overprivileged accounts remain the clearest signs that entitlement lifecycle governance is not keeping pace with hybrid operations.
- Regulated organisations should tie cloud and AI expansion to identity readiness so access remains traceable, revocable, and auditable.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 addresses the attack and risk surface, while NIST CSF 2.0 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | The article centres on governing who gets access and how that access is documented and reviewed. |
| GV.OC-01 — Organisational Context | Digital sovereignty is framed here as a business and governance objective, not only a technical one. | |
| GV.RM-01 — Risk Management Strategy | The article connects orphaned and overprivileged access to enterprise risk in regulated environments. | |
| Recommendation — Apply PR.AA-05 to keep entitlement decisions traceable, reviewable, and tied to business ownership. Align identity governance with the organisation's sovereignty, compliance, and resilience objectives. Use GV.RM-01 to prioritise entitlement risks that can undermine regulated operations. | ||
| CIS Controls v8 | CIS-5 — Account Management | Orphaned accounts and lifecycle discipline are central themes in the article. |
| Recommendation — Use CIS-5 to enforce account ownership, offboarding, and periodic review of active access. | ||
| OWASP Non-Human Identity Top 10 | NHI-01 — Improper Offboarding | The article explicitly highlights access that should not survive the end of employment or engagement. |
| NHI-05 — Overprivileged NHI | Overprivileged accounts are named as a risk the partnership aims to reduce. | |
| Recommendation — Map access removal failures to NHI-01 and close residual accounts after role changes or departures. Use NHI-05 to identify entitlements that exceed task need and reduce their scope. | ||
Key terms
- Access Governance: Access governance is the policy and workflow layer that manages how access is requested, approved, certified, and revoked. In SaaS environments it helps standardise control across many applications, reducing inconsistency between teams. It is most effective when it covers both human accounts and non-human identities.
- Digital sovereignty: An operating model in which an organisation retains meaningful control over where data lives, who administers the service, and how policy is enforced. For identity teams, sovereignty is only real when access, logs, and recovery remain under the organisation's governance boundary.
- Orphaned Account: An orphaned account is an identity that remains active without a clear owner or business purpose. These accounts are dangerous because they often escape review, retain unnecessary access, and provide attackers with low-friction entry points into otherwise governed environments.
- Overprivileged Account: An overprivileged account has more access than its job or workload requires. In cloud and NHI settings, that excess access increases blast radius, complicates audits, and gives attackers more options after compromise. The control goal is to reduce permissions to the smallest workable set and keep them time-bound where possible.
Deepen your knowledge
NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM or identity governance programme, it is worth exploring.
Published by the NHIMG editorial team on June 24, 2026.
Updated on October 11, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org