TL;DR: Opal Security reports that across half a million access requests, median approval time reached 15 minutes, some latencies exceeded 24 hours, 43.5% of granted access went unused for more than 90 days, and agent and non-human identities grew 2,300%, exposing how manual review no longer scales. Review-based IAM assumes access can be assessed slowly and still remain meaningful, but that assumption collapses when access volume and identity sprawl outrun human judgment.
At a glance
What this is: This is an analysis of AI-assisted access review, showing that manual IAM processes are overwhelmed by request volume, stale grants, and rapid growth in non-human identities.
Why it matters: It matters because IAM teams now have to govern access decisions for humans, service accounts, and agents at a pace that traditional review workflows cannot sustain.
👉 Read Opal Security's analysis of how AI review exposes the limits of manual IAM
Context
Manual access review depends on reviewers having enough context and enough time to judge whether a grant is justified, narrow, and still needed. In practice, that model slows sharply as request volume rises and as identities become harder to interpret.
The article frames a governance problem that spans human IAM and NHI control. When agents and non-human identities multiply, review queues fill with decisions that are too repetitive for manual handling and too important to leave ungoverned.
Opal Security uses access request data to show that the issue is not only speed but decision quality at scale. The underlying question for identity programmes is whether approval workflows can still preserve least privilege when the volume of requests outpaces human reviewers.
Key questions
Q: What breaks when access reviews are still mostly manual?
A: Manual reviews fail when identities change state, permissions spread across multiple systems, or access is granted too quickly for periodic certification to catch it. In AI-heavy environments, that leaves privilege in place long after the conditions that justified it have changed.
Q: Why do non-human identities complicate IAM governance?
A: Non-human identities complicate IAM governance because they do not behave like people. They authenticate without interactive sessions, persist across deployments, and can be shared or embedded in code. That means the controls that work for users, such as MFA and periodic review cadences, often miss the real NHI risk, which is secret exposure and privilege drift.
Q: How should security teams prove authorization controls are operating effectively?
A: Security teams should require evidence that access controls were active, monitored, and reviewed over time, not just documented once. That means linking rule changes, approvals, logs, and exception handling into a single audit trail. For application authorization, the control must be testable in production, because compliance depends on observed operation, not declared intent.
Q: What should organisations do before they automate access decisions?
A: They should make sure the underlying identity data is accurate, complete, and owned. Automation only improves governance when the access catalog, role model, and entitlement records are already trustworthy; otherwise it accelerates bad decisions instead of fixing them.
How it works in practice
Why manual access review slows down at scale
Manual access review is a decision workflow, not just a ticket step. Reviewers are expected to weigh requester context, existing entitlements, resource sensitivity, and whether a narrower access path would work instead. That is workable when request volume is modest. At high volume, latency grows because each decision requires a person to reconstruct context that the system should already hold. The result is not merely slower approvals but weaker governance, because long queues encourage rubber-stamping and stale access persistence.
Practical implication: move routine approvals out of human queues and reserve human review for exceptions that genuinely need judgment.
Why agent and NHI growth changes the IAM control problem
Agent and non-human identities change the shape of the access problem because they do not behave like ordinary employees. They often lack clear descriptions, hold more entitlements than people, and create more request paths than traditional review processes were designed to inspect. That means governance has to work with incomplete manifests, uneven ownership, and expanding machine-to-machine access. The control failure is not just oversight volume. It is that manual IAM assumes the reviewer can understand the identity well enough to assess it in time.
Practical implication: build separate governance handling for NHIs and agents instead of forcing them through the same review model used for human users.
How AI review changes the access decision workflow
AI review systems shift access governance from pure queue processing to policy-assisted decisioning. The system gathers context from tickets, collaboration tools, incident systems, and device data, then reasons against policy before recommending or routing a request. In that model, the reviewer is no longer reconstructing the case from scratch. The important architecture change is that the decision arrives with the rationale and the evidence trail attached. That makes the workflow more auditable and more scalable, provided the organisation is willing to define what the system may decide versus what it must escalate.
Practical implication: define decision boundaries for AI-assisted review so the system can approve routine cases and escalate genuinely ambiguous ones.
NHI Mgmt Group analysis
Manual approval workflows were designed for bounded request volumes, not for identity estates that generate decisions continuously. Once access requests become a high-throughput stream, the reviewer is no longer judging meaningful exceptions. They are triaging backlog, which turns review into a latency problem instead of a governance control. The practical consequence is that least privilege becomes harder to maintain because the decision system is slower than the identity system it is supposed to govern.
AI review is best understood as governance automation, not access automation. The value is not that the model grants more access. The value is that it reconstructs the context a human would need, then routes the decision according to policy and confidence. That matters because IAM programmes increasingly fail from context starvation, not from a lack of ticket volume alone. Practitioners should treat decision quality as the design target, not queue reduction as the metric.
Identity sprawl is now a control-design issue, not a reporting issue. When agent and non-human identities grow rapidly, the programme can no longer assume that every identity will be described, owned, and reviewed on a human schedule. That assumption was built for stable user populations and breaks when machine identities multiply faster than governance cycles. The implication is that access governance has to be designed around identity class, not just around request type.
Review-based IAM is becoming a selective control, not a universal one. The article shows a clear boundary between routine decisions and cases that still need expert judgment. That boundary is where modern governance should focus. If every request is treated as equally manual, the process degrades; if routine grants are automated and exceptions are elevated, the human reviewer can spend time where policy nuance actually exists.
Access decisions are increasingly the front line of identity security. The article's larger signal is that IAM, IGA, and NHI governance are converging on the same operational problem: who or what should have access, under what conditions, and for how long. Programmes that still separate human entitlement review from NHI lifecycle governance will miss how closely those controls now interact. Practitioners need a common decision model across identity classes.
What this signals
Decision context is becoming the real control plane for IAM. When requests arrive faster than people can interpret them, the quality of the context attached to the decision matters more than the speed of the queue. Programmes should expect access governance to shift from after-the-fact review toward context-rich approval at issuance time.
Identity sprawl now spans human, service, and agent identities in the same governance workflow. That means entitlement review, role design, and lifecycle management can no longer be run as separate conversations. The programme that treats NHIs as a side case will miss where privilege is actually accumulating.
Review fatigue is a structural risk, not a staffing problem. If every access request requires the same human effort, the process will eventually encourage delay, exception drift, or rubber-stamping. Teams should watch for that pattern and redesign the workflow before reviewers become the bottleneck.
For practitioners
- Separate routine from exceptional access decisions Define which requests can be policy-scored or auto-approved and which must be routed to a human reviewer with explicit escalation criteria.
- Build different governance paths for NHIs and humans Classify service accounts, agents, and human users separately so review logic can reflect different ownership, lifespan, and entitlement patterns.
- Attach decision context to every approval Require access rationale, identity context, and policy basis to travel with the decision record so auditors can reconstruct why it was granted.
- Use access review data to find stale grants Prioritise entitlements that remain unused after approval and feed them into recertification or cleanup workflows before they accumulate.
Key takeaways
- Manual access review becomes unreliable when request volume and identity sprawl outrun the time humans have to evaluate each case.
- The article shows that agent and non-human identities are growing into the same governance problem as human access, but with weaker context and less reviewability.
- The control shift is toward policy-driven decisioning for routine access and human judgment reserved for the requests that are actually ambiguous or risky.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 and MITRE ATT&CK address the attack and risk surface, while NIST CSF 2.0 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-05 — Overprivileged NHI | The article highlights excess entitlements on agents and non-human identities. |
| NHI-10 — Human Use of NHI | The article discusses humans reviewing and governing access held by agents and service accounts. | |
| Recommendation — Reduce overprivileged NHIs by separating their review and approval rules from human access workflows. Govern human oversight of NHI access by logging why each entitlement was granted and who approved it. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | The core problem is how access approvals and entitlements are assigned and reviewed at scale. |
| Recommendation — Use PR.AA-05 to formalise who can approve access, which entitlements are allowed, and when escalation is required. | ||
| CIS Controls v8 | CIS-5 — Account Management | The article is about governing accounts and their access decisions across large populations. |
| Recommendation — Apply CIS-5 to identify unused accounts and revoke access that no longer serves an operational purpose. | ||
| MITRE ATT&CK | TA0004 — Privilege Escalation | Unchecked approvals can widen effective privilege and increase escalation opportunity. |
| Recommendation — Map excessive approval outcomes to privilege escalation pathways and prioritise the most over-granted identities. | ||
Key terms
- Access decisioning: Access decisioning is the process of evaluating whether a user, service account, or agent should receive a requested entitlement. In identity programmes, it combines policy, context, and risk signals so approvals are consistent, auditable, and aligned to least privilege.
- Non-Human Identity (NHI): A digital identity assigned to a non-human entity such as a software application, service account, API key, bot, machine, or AI agent that enables it to authenticate and interact with systems without direct human involvement. NHIs now outnumber human identities in most enterprises by 25 to 50 times.
- Entitlement Drift: Entitlement drift is the slow accumulation of permissions that no longer match the original purpose, role, or workload. In cloud-native and NHI-heavy environments, it usually happens because access changes faster than review cycles, leaving organizations with more privilege than they intended.
- Decision context: The surrounding facts needed to explain why an identity acted, including trigger, tool, target, and policy state. For autonomous actors, decision context is essential because logs alone may show that something happened, but not whether it was reasonable or allowed in that moment.
What's in the full announcement
Opal Security's full article covers the operational detail this post intentionally leaves for the source:
- The access-review workflow design behind Paladin's decisioning model and how it reasons over policy.
- The specific connected systems used to gather context for access decisions, including tickets, docs, incidents, and approvals.
- The role boundaries for when AI can recommend, decline, or escalate an access request.
- The role-mining and policy-suggestion use cases that extend the approach beyond approvals.
Deepen your knowledge
NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.
Published by the NHIMG editorial team on August 11, 2026.
Updated on October 7, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org