AI-powered access modeling exposes the limits of role sprawl

At a glance

What this is: This is a discussion of AI-powered access modelling and its main finding that role sprawl is a by-product of static, spreadsheet-managed role governance.

Why it matters: It matters because IAM teams responsible for human access, NHI governance, and autonomous access models all need role structures that can keep pace with change without losing least-privilege control.

Context

A role model is the structure that maps people to access. In this article, the governance gap is not whether roles exist, but whether they can stay current as SaaS adoption, organisational change, and mergers keep changing the access picture.

The source argues that manual role creation and maintenance create stale, overlapping roles that frustrate users and weaken least privilege. That puts pressure on IAM teams to treat access modelling as a continuous governance function rather than a one-time design exercise.

Key questions

Q: What breaks when role modelling is still managed in spreadsheets?

A: Spreadsheet-managed role modelling breaks when access changes faster than humans can reconcile it. The model becomes stale, roles overlap, and least privilege turns into an aspirational policy rather than a governable control. That is why access modelling has to move from periodic reconstruction to continuous calibration based on real usage and business change.

Q: Why do duplicate roles increase identity risk after acquisitions?

A: Duplicate roles increase risk because acquisitions often leave parallel access models in place, which creates multiple versions of the same entitlement logic. That makes it harder to know which role is authoritative, expands unnecessary access, and complicates downstream certification. The more parallel models you keep, the harder least privilege becomes to enforce.

Q: How can teams tell whether role sprawl is getting out of hand?

A: Role sprawl is getting out of hand when similar roles keep appearing, role names no longer map cleanly to business functions, and certification reviews become cluttered with overlapping entitlements. Those are signals that the model is losing explainability and that the role layer itself is becoming part of the access problem.

Q: Should organisations trust AI to create access roles automatically?

A: Organisations should use AI to propose roles, not to own the decision. AI can surface patterns, flag redundant access, and speed up cleanup, but the governance choice still belongs to a human role owner who understands context, exceptions, and business intent. Automation should improve role quality, not replace accountability.

Technical breakdown

Why spreadsheet-based role modelling breaks at SaaS scale

Traditional role modelling depends on interviews, spreadsheets, and human memory to infer what access a role should have. That works only when applications are stable and change is slow. Once SaaS sprawl, joiner-mover-leaver churn, and acquisitions expand the number of entitlements, static models become outdated faster than they can be reviewed. The result is not just inefficiency. It is role overlap, hidden exceptions, and loss of explainability about why a role exists or what it should contain. Practical implication: treat manual role building as a temporary bootstrap method, not a sustainable operating model.

Practical implication: move role governance away from spreadsheet ownership and into a continuously updated access model.

How AI-assisted role discovery and hygiene change access modelling

AI-assisted access modelling uses access patterns, usage data, identity attributes, and peer-group analysis to identify candidate roles and right-size existing ones. Role discovery finds common access clusters, while role hygiene removes access that is no longer used or no longer aligned to current job patterns. This does not replace governance judgment. It changes the workload from inventing roles by hand to validating machine-suggested structures against business context. Practical implication: use AI to surface role candidates and stale permissions, then force human approval on the final model.

Practical implication: validate AI-generated role candidates against business context before they become production entitlements.

Why role sprawl undermines least privilege and auditability

Role sprawl happens when multiple teams create similar or duplicate roles over time, often after re-orgs or acquisitions. Each extra layer adds ambiguity about which role is authoritative, which permissions are still needed, and which access can be removed. That weakens least privilege because excess access becomes normalised inside bloated roles. It also hurts auditability because reviewers end up certifying noisy role bundles instead of meaningful access decisions. Practical implication: reduce role redundancy before certification, otherwise access reviews will keep validating the wrong unit of control.

Practical implication: collapse duplicate roles before certification so reviews target meaningful access patterns rather than noise.

Threat narrative

Attacker objective: The objective is not a single named attacker gain, but the accumulation of excess and poorly governed access that broadens internal exposure.

1. Entry occurs through business change, such as onboarding new SaaS applications or acquiring another company, which introduces new access patterns into an existing role model.
2. Credential or role-state exposure follows when the organisation relies on static role definitions that no longer match how access is actually used.
3. Escalation appears as overlapping or duplicate roles accumulate, allowing excessive access to persist inside apparently legitimate role structures.
4. Impact is a weakened least-privilege posture and a role model that becomes too stale and opaque to govern effectively.

Breaches seen in the wild

• Scania insurance portal breach 2025: An attacker used an external user login, likely stolen by infostealer malware, to take insurance claim documents from a Scania portal.

Read our 52 NHI Breaches Analysis report for a comprehensive view of breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Role sprawl is a governance failure, not just an efficiency problem: once similar roles begin multiplying across teams and acquisitions, the organisation loses a clear source of truth for access. That weakens least privilege because excess permissions are normalised inside the role layer. The practitioner consequence is that role governance has to be treated as a control surface, not an admin convenience.

Role modelling needs continuous calibration, not periodic reconstruction: static role design assumes the business settles long enough for manual maintenance to catch up. SaaS growth and joiner-mover-leaver churn break that assumption, so the access model must be recalibrated from usage and context data. The practitioner implication is to govern role quality as an ongoing lifecycle function.

Role hygiene is the named concept that matters here: it is the discipline of keeping roles current as tools, job patterns, and access needs change. Without role hygiene, even well-designed roles become stale, redundant, and hard to certify. The practitioner implication is to measure the health of the role model, not just the count of roles.

AI changes the economics of access governance, but not the accountability model: AI can surface role candidates, identify outliers, and compress the time needed to build or clean roles. The human still owns the final decision, which preserves governance boundaries while shifting the work from manual assembly to exception handling. The practitioner implication is to use AI for scale, not to outsource accountability.

Continuous access modelling is becoming a prerequisite for modern identity programmes: when organisations cannot keep access models current, least privilege becomes aspirational and audits become harder to defend. The field is moving toward living access models that can absorb change without waiting for annual redesign. The practitioner implication is to align role governance with the pace of business change, not the pace of spreadsheet updates.

What this signals

Role hygiene is now a lifecycle discipline: teams that treat role clean-up as a one-off project will keep accumulating overlapping access structures. The practical shift is to tie role review to change events, usage data, and certification outcomes so the model stays governable as the business changes.

AI-assisted access modelling changes the operating rhythm, not the control objective: the aim is still least privilege, but the path there is faster discovery, cleaner roles, and fewer stale exceptions. That makes the access model more responsive to SaaS growth and merger activity without weakening human accountability.

For practitioners

• Standardise role discovery around current access patterns Use access patterns, identity attributes, and usage data to identify role candidates instead of rebuilding roles from interviews and spreadsheets.
• Establish role hygiene reviews after business change Reassess roles after acquisitions, SaaS onboarding, and major job-family changes so duplicate or stale roles do not persist.
• Use usage data to right-size role membership Treat unused entitlements as evidence that the role definition may be too broad, then narrow it before certification or recertification.
• Separate AI recommendations from approval authority Let AI propose role groupings and cleanup candidates, but require human owners to approve the final access model.
• Measure role redundancy as a governance signal Track similar or overlapping roles as a sign that the access model is drifting away from least-privilege intent.

Key takeaways

• Manual role modelling becomes brittle as SaaS growth, acquisitions, and joiner-mover-leaver churn increase the number of access changes teams must absorb.
• The main failure mode is role sprawl, which creates redundant roles, stale permissions, and weaker least-privilege outcomes.
• AI-assisted discovery and hygiene can improve role quality, but human approval remains necessary to preserve governance accountability.

Key terms

• Role Sprawl: Role sprawl is the gradual growth of overlapping or duplicated roles that are hard to review and even harder to retire. In SAP environments, it usually appears when context values are inconsistent, naming is uncontrolled, or teams build new roles instead of refining the governing model.
• Role Hygiene: Role hygiene is the ongoing practice of keeping roles current, accurate, and non-redundant as business needs change. In an IAM programme, it means removing stale access, consolidating duplicates, and validating that roles still reflect actual work patterns and usage.
• Access modelling: Access modelling is the process of analysing how identities use permissions and grouping them into roles or policies that match real work. In identity governance, it is the structural layer that determines whether requests, certifications, and audits are manageable or overwhelmed by role sprawl.
• Dynamic Access Control: Dynamic Access Control is an access decision model that changes permissions in real time based on current context. It evaluates signals such as user risk, device posture, location, time, resource sensitivity, and behavior, then grants, limits, or revokes access continuously. It is commonly implemented with policy engines and identity telemetry.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.