TL;DR: Clarity Security argues that acquisitions, rapid hiring, and AI tool adoption create human and non-human identities faster than ticket-based governance can inventory, review, and revoke them, leaving access drift, orphaned accounts, and over-scoped permissions outside review cycles. Scalable identity security now depends on continuous lifecycle governance and consolidated visibility, not periodic cleanup after the business has already moved.
At a glance
What this is: This is a Clarity Security analysis of how business growth creates identity sprawl across human and non-human access, and why manual governance falls behind.
Why it matters: It matters because IAM, IGA, PAM, and NHI programmes all break down when lifecycle control cannot keep pace with acquisitions, hiring surges, and shadow-adopted tools.
👉 Read Clarity Security's analysis of scalable identity governance for business growth
Context
Identity sprawl is the steady accumulation of accounts, entitlements, integrations, and credentials faster than a governance programme can see and control them. In this article, that sprawl shows up across acquisitions, hiring surges, role changes, and department-led AI adoption.
The governance gap is not limited to human users. Clarity Security describes service accounts, API keys, and OAuth connections created outside IT control, then left outside review cycles and offboarding workflows. For IAM and NHI teams, the problem is less about any single bad request and more about lifecycle processes that cannot absorb business change at scale.
Key questions
Q: How should security teams reduce identity sprawl without weakening governance?
A: Start by identifying where identity, access, and device controls are split across tools, then remove duplicate policy paths before consolidating. The goal is not only fewer platforms but a single, reliable source of truth for access state, lifecycle events, and policy enforcement. That is what makes governance scale without creating hidden exceptions.
Q: Why do manual access reviews fail in growing enterprises?
A: Manual reviews fail because the review process cannot keep up with the rate of entitlement change. By the time reviewers see the data, some accounts are already stale, some approvals are obsolete, and some revocations are overdue. That creates a control lag that gets worse as applications, users, and compliance obligations expand.
Q: What breaks when non-human identities are left out of governance?
A: When non-human identities are left out, ownership becomes unclear, credentials stay active too long, and audit cannot verify who approved the access or why it still exists. That creates a blind spot for service accounts, bots, and AI agents that often hold powerful permissions but rarely get the same lifecycle scrutiny as people.
A: Organisations should prioritise automated lifecycle management when manual checklists can no longer keep up with joiner, mover, and leaver changes. The control matters most when users need day one access on arrival and immediate removal on exit. Automation reduces missed deprovisioning, shortens time to productivity, and keeps application access aligned with role changes and HR events.
Technical breakdown
Why periodic access certifications miss growing identity estates
Periodic access certifications only validate the inventory that exists at the moment of review. They do not see accounts or entitlements created after the cycle begins, and they do not reliably catch access that should have been removed when roles changed or a contractor departed. In a growing organisation, that leaves the programme governing snapshots while the environment keeps moving. The technical problem is not the certification itself. It is the assumption that point-in-time review can substitute for continuous lifecycle control across human and non-human identities.
Practical implication: treat recertification as evidence of oversight, not as the control that keeps access current.
How acquisitions create inherited non-human identity risk
An acquisition can import a separate directory, different access policies, orphaned service accounts, and integrations with no clear owner. Those identities often predate the acquiring organisation’s governance model, so the combined environment starts with unknown scope and inconsistent controls. Manual reconciliation can reduce that risk, but only if the inventory is complete and stays current after close. Otherwise, the inherited environment becomes a partially mapped identity estate that quietly extends the blast radius of any later compromise or audit gap.
Practical implication: extend identity inventory, ownership, and revocation processes into the acquired environment immediately after close.
Why AI tool adoption expands the non-human identity surface
Department-level AI and automation adoption creates service accounts, API keys, and OAuth connections that behave like operational access, even when they are not provisioned through central IT. These identities often lack HR-linked lifecycle triggers, so they persist after the use case changes and remain invisible to standard JML workflows. The security issue is not the AI label. It is the ungoverned production access attached to tools that can be copied across teams without central approval or review.
Practical implication: inventory AI-connected integrations as production identities and bring them into the same governance model as other machine access.
Threat narrative
Attacker objective: The practical objective is persistence inside an expanding identity estate through unmanaged access paths that remain available long after the original business event has passed.
- Entry occurs through legitimate business growth events such as acquisition, rapid hiring, or department-led AI adoption, which create identities outside the existing governance boundary.
- Credential and access scope then accumulate through manual provisioning, inherited directories, orphaned accounts, and integrations that are never fully reconciled.
- Escalation happens when those unmanaged identities retain broader access than their current purpose requires, while periodic reviews miss changes made between cycles.
- Impact is a widening identity estate with hidden blast radius, slower offboarding, and a higher chance that audit or breach discovery exposes long-standing access drift.
Breaches seen in the wild
- Azure Key Vault Contributor escalation 2024: Datadog found Azure Key Vault Contributor could add itself to access policies and read every secret, key and certificate in a vault.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 150+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Static identity governance assumptions break the moment the business starts changing faster than the review cycle. Quarterly certifications, annual policy reviews, and ticket-based JML workflows were designed for a stable inventory of users and systems. They fail when identities are created, modified, and retired continuously across acquisitions, hiring, and AI adoption. The implication is that governance must be evaluated as a live operating model, not a periodic administrative task.
Identity blast radius is now a growth metric, not just a compromise metric. The article correctly shows that each new business event expands the set of identities the programme must see and control. When inherited directories, orphaned service accounts, and OAuth connections are left outside scope, the organisation is not merely behind on cleanup. It is running with an unknown blast radius that compounds with every integration.
Non-human identity visibility is the dividing line between scalable and symbolic governance. A programme that can only govern what HR knows about will never keep pace with tool-led automation or shadow-adopted AI connections. That is why NHI governance now sits alongside human lifecycle control as a core identity discipline, not a specialist side project. Practitioners should treat hidden machine access as a board-level exposure, not an edge case.
Lifecycle governance has to move from event handling to continuous control. The deeper lesson is that business events should trigger automated policy enforcement, not create backlog. When the environment changes faster than the programme can reconcile, least privilege becomes an aspiration rather than an operating condition. The practitioner conclusion is straightforward: the identity function must absorb growth in real time or be overtaken by it.
What this signals
Identity governance has become a growth problem as much as a security problem. When acquisitions, hiring surges, and AI adoption all expand the identity estate at once, the programme has to govern change continuously or accept that its view of access will always be stale. The practical shift is from review-centric administration to lifecycle control that updates with the business.
Non-human identity visibility is the control plane that now separates resilient programmes from brittle ones. Service accounts, API keys, and OAuth connections are no longer edge cases once business units can create them without IT. A programme that cannot inventory and govern those identities cannot claim full coverage of production access.
Access review processes assume access persists long enough to be reviewed; growth events often make that assumption wrong. That is why continuous provisioning, revocation, and ownership assignment matter more than periodic certifications when the environment is changing every day.
For practitioners
- Automate joiner-mover-leaver control Replace ticket-led provisioning and removal with lifecycle rules that update access when people join, move, or leave the organisation.
- Extend inventory to non-human identities Build a single inventory for service accounts, API keys, OAuth connections, and other production integrations so they are reviewed with the rest of the identity estate.
- Create acquisition identity intake Require every acquired directory, account set, and application integration to enter governance as soon as the deal closes, not after manual reconciliation begins.
- Separate business-led AI pilots from production access Treat department-created AI tools as governed identities once they touch production systems, and force ownership before access is expanded beyond the pilot team.
Key takeaways
- Business growth is now creating identity risk faster than manual governance can absorb, especially when acquisitions and AI adoption introduce identities outside central control.
- The most consequential failures are visibility gaps, orphaned access, and over-scoped permissions that accumulate between review cycles.
- Continuous lifecycle governance and consolidated identity inventory are the controls that keep least privilege real as the business scales.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 and MITRE ATT&CK address the attack and risk surface, while NIST CSF 2.0 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-01 — Improper Offboarding | The article highlights delayed removal and forgotten access after role changes and departures. |
| NHI-05 — Overprivileged NHI | The article repeatedly shows access granted broader than the role or integration required. | |
| NHI-09 — NHI Reuse | Accounts, integrations, and credentials persist across changes and get reused beyond their original context. | |
| Recommendation — Automate offboarding so identities are revoked when their business purpose ends. Review non-human entitlements for scope creep and reduce privileges to the minimum operational set. Track reused service accounts and connections so ownership and purpose stay current. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | The article is about governing access as the business changes across people and machines. |
| Recommendation — Continuously govern entitlements so permissions stay aligned to role and purpose. | ||
| CIS Controls v8 | CIS-5 — Account Management | Account lifecycle control is central to the article's argument about scalable governance. |
| Recommendation — Centralise account management and remove stale identities before they become backlog. | ||
| MITRE ATT&CK | TA0006; TA0008 — Credential Access; Lateral Movement | The article's unmanaged identities increase the opportunity for credential abuse and lateral movement. |
| Recommendation — Map unmanaged identities to credential-access and lateral-movement risk in threat modelling. | ||
Key terms
- Identity Sprawl: Identity sprawl is the uncontrolled growth of identities, entitlements, and credentials across an environment. For NHIs, it usually appears when automation creates accounts faster than governance teams can inventory, review, and remove them. The result is hidden access, weak accountability, and a wider attack surface.
- Lifecycle Governance: Lifecycle governance is the set of controls that cover creation, assignment, review, rotation, and retirement of identities and credentials. For NHIs, it is the difference between a temporary automation asset and a persistent access risk. Strong lifecycle governance keeps ownership and expiry tied to actual business use.
- Non-Human Identity (NHI): A digital identity assigned to a non-human entity such as a software application, service account, API key, bot, machine, or AI agent that enables it to authenticate and interact with systems without direct human involvement. NHIs now outnumber human identities in most enterprises by 25 to 50 times.
- Answer Drift: Answer drift is the gradual change in a model’s responses over time, often showing up as reduced consistency or increasing error rates. It can signal degraded grounding, shifting data quality, or prompt and retrieval issues. Monitoring drift helps teams catch reliability problems before they become widespread user-facing failures.
What's in the full article
Clarity Security's full article covers the operational detail this post intentionally leaves for the source:
- The three growth patterns that pressure identity governance, including acquisitions, headcount expansion, and AI adoption
- The operational differences between manual reconciliation and continuous lifecycle governance
- The business-case framing for reducing backlog, exam findings, and offboarding delays
- The article's examples of how non-human identities enter production outside central IT control
Deepen your knowledge
NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.
Published by the NHIMG editorial team on May 14, 2026.
Updated on October 7, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org