TL;DR: Identity stacks manage policy and intent well, but they still miss the authority pathways created by inheritance, delegated access, and cross-system relationships, according to Gathid. The structural gap is now the real identity risk, because review tools cannot see what authority has accumulated across the environment.
At a glance
What this is: This is an analysis of why modern IAM can manage policy and intent yet still fail to reveal the authority pathways that actually create control across connected systems.
Why it matters: It matters because IAM, IGA, PAM and NHI programmes can all miss real exposure when inherited access, delegated control and cross-system relationships are not modelled together.
Context
Modern identity programmes are good at governing policy, but policy is not the same thing as actual authority. The article argues that this gap is not a tooling failure so much as a visibility failure in complex environments where identity, role inheritance and delegation combine across platforms.
For IAM and NHI practitioners, the core problem is that a control stack can certify what was intended without showing what was effectively created. That matters when service accounts, automation accounts and cross-account trusts hold authority that no single system can see in isolation.
The practical question is no longer whether organisations have access reviews, provisioning and PAM in place. It is whether those controls can reconstruct the authority pathways that emerge after groups, roles, credentials and systems interact over time.
Key questions
Q: What breaks when IAM tools only review policy intent?
A: They miss the authority that emerges from inheritance, delegation and role combinations across systems. A clean approval record can still coexist with a hidden control path, especially when cross-account trusts or nested groups extend reach beyond the original request. Governance has to measure effective control, not just approved access.
Q: Why does identity create more risk when privilege is inherited across systems?
A: Inherited privilege hides where authority really comes from and makes blast radius difficult to see. A single account may gain access through nested roles, integrations or delegated permissions, so compromise of one identity can affect multiple systems. That is why relationship mapping is essential for modern IAM and NHI governance.
Q: How can teams detect hidden authority pathways before they become incidents?
A: By modelling identities, groups, roles, credentials and system relationships together, then recomputing that model regularly against authoritative enterprise state. If the model is limited to one platform at a time, it will miss composite access paths and delegated control chains that create real exposure.
Q: Should organisations apply the same access review process to human and non-human identities?
A: No. Human access reviews can work on periodic certification cycles, but non-human identities often change faster and need event-based review tied to deployment, rotation, or decommissioning. The better model is shared governance with different review mechanics, so the process matches how each identity class is created, used, and retired.
Technical breakdown
Authority pathways versus policy intent
Policy intent describes who should have access. Authority pathways describe how effective control is actually formed when inheritance, delegation, nested groups and cross-system permissions are combined. In a modern enterprise, these pathways can create control that no single identity provider or governance tool can infer because each platform only sees its own scope. That is why a clean access review can still coexist with hidden authority accumulation. The technical problem is not that the rules are missing, but that the rules are distributed across systems that do not model the whole relationship graph.
Practical implication: model identity relationships across systems, not just entitlements inside each system.
Why access reviews miss effective control
Access reviews are point-in-time checks against declared access. They work best when authority is explicit, stable and owned by one control plane. They fail when authority is emergent, such as when a service account inherits a role that combines with another entitlement to create administrative reach. They also miss dormant machine identities whose credentials still work long after the original use case ended. The result is a governance process that validates intent while leaving effective control unmeasured.
Practical implication: supplement recertification with relationship analysis that surfaces emergent privilege combinations.
Cross-account trusts and delegated access paths
Cross-account trusts and delegated access are structurally different from ordinary role assignment because they extend authority through chained assumptions. A temporary automation account may remain active, keep its credentials and continue to reach production through inherited roles even after the original project ends. That is not a provisioning mistake in the narrow sense. It is an authority pathway that persists because the environment never recomputes the full chain of trust and ownership across accounts, systems and identities.
Practical implication: continuously recompute delegated access chains and retire authority when the business purpose expires.
Breaches seen in the wild
- Azure Key Vault Contributor escalation 2024: Datadog found Azure Key Vault Contributor could add itself to access policies and read every secret, key and certificate in a vault.
- BeyondTrust breach 2024: A stolen BeyondTrust Remote Support API key let a China state-sponsored actor reset accounts and reach US Treasury workstations in 2024.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Authority pathways are the real blind spot in modern IAM. The article’s central point is that policy-centric controls do not reveal how effective authority emerges once identities, roles and systems start inheriting from one another. That means the governance problem is structural, not procedural. Practitioners should treat authority mapping as a distinct control layer, not as a feature of existing IAM tooling.
Access reviews certify intent, not accumulated control. Recertification can confirm that a role was approved, but it cannot show whether that role now combines with other entitlements to create unintended operational reach. This is why mature governance programmes can still miss privileged exposure in complex environments. Practitioners need visibility into relationship chains, not only access lists.
Non-human identities make the gap worse because their authority often bypasses human governance assumptions. Service accounts, automation accounts and delegated machine access can persist outside the lifecycle assumptions built for employees. When those identities inherit permissions across systems, the resulting authority may never enter the human review workflow at all. Practitioners must govern NHI authority as an operating reality, not a special case.
Ephemeral project access becomes durable risk when offboarding fails to collapse the trust chain. Temporary access is only temporary if downstream roles, cross-account trusts and retained credentials are actually removed when the business use case ends. The article shows how easily a project account can become a standing control path. The implication is that identity governance has to understand closure, not just creation.
Identity blast radius is a better lens than isolated least privilege. The article implies that the unit of risk is not one account or one role, but the combined effect of relationships across the environment. That is where current stacks lose context and where exposure accumulates quietly. Practitioners should measure how far authority can propagate, then manage the blast radius as a first-class risk dimension.
From our research library:
- 97% of NHIs carry excessive privileges, increasing unauthorised access and broadening the attack surface, according to the Ultimate Guide to NHIs.
- Read next: Cloud PAM and CIEM Guide
What this signals
Identity blast radius: once authority is created through inheritance and delegation, the meaningful question becomes how far that control can propagate across the environment. Practitioners should expect the highest-risk exposure to sit in composite paths that no individual tool fully owns, which is why relationship modelling belongs alongside IAM, IGA and PAM.
Access reviews remain necessary, but they are not sufficient when effective authority is assembled across platforms. The programme signal to watch is whether your governance process can explain why a permission exists, who can extend it, and what downstream systems inherit from it.
For practitioners
- Map authority pathways across systems Build a relationship graph that connects identities, groups, roles, credentials and cross-account trusts so reviewers can see how authority is actually formed.
- Rework access reviews around effective control Add analysis for inherited permissions, nested groups and role combinations so reviews expose accumulated authority rather than only approved entitlements.
- Inventory dormant automation and service accounts Find non-human identities that still hold production access after the original project or owner relationship ended, then validate whether the authority chain is still justified.
- Recompute delegated access daily Use a deterministic daily model of identity relationships so authority changes, drift and residual privileges are visible before they become incidents.
Key takeaways
- Modern IAM stacks can validate policy intent while still missing the authority that emerges across inherited and delegated relationships.
- The article’s core warning is structural: hidden authority pathways, not authentication failure, are where identity risk accumulates.
- Teams need relationship-aware governance that models how authority propagates, especially across non-human identities and cross-account trusts.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 and MITRE ATT&CK address the attack and risk surface, while NIST SP 800-53 Rev 5 and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-05 — Overprivileged NHI | The article centres on excess authority created across service and automation identities. |
| NHI-01 — Improper Offboarding | Dormant project accounts and retained machine access are a direct offboarding failure. | |
| Recommendation — Map accumulated authority paths and reduce overprivilege where inherited access exceeds business need. Revoke residual access when projects end and confirm downstream trusts are removed. | ||
| NIST SP 800-53 Rev 5 | AC-6 — Least Privilege | The article shows least privilege failing when privileges combine across systems. |
| Recommendation — Apply AC-6 to limit role combinations and review effective privilege, not just assigned access. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | The topic is about entitlement visibility and authorisation drift across systems. |
| Recommendation — Use PR.AA-05 to govern entitlements as a connected model across identity platforms. | ||
| MITRE ATT&CK | TA0004;TA0008 — Privilege Escalation; Lateral Movement | The article describes how composite access paths create escalation and cross-system reach. |
| Recommendation — Map compounded authority chains to escalation and lateral-movement exposure in threat detection. | ||
Key terms
- Authority Pathway: An authority pathway is the chain of relationships that turns separate identities, roles, credentials, and systems into effective control. It is the practical route by which permission accumulates across platforms, often without any single system showing the full picture. In governance terms, it is the real access surface, not the approved one.
- Effective Control: Effective control is the real ability to exercise a credential, token, or account, regardless of who originally created it or where it is stored. In identity governance, this is the boundary that matters for auditability, accountability, and separation of duties because downstream systems only see valid authority.
- Identity Blast Radius: The amount of damage a compromised identity can cause across systems, data, and infrastructure. In NHI environments, it is shaped by permissions, network reach, and administrative capability rather than by the credential alone. Reducing blast radius is a containment strategy that limits lateral movement and data exposure.
- Cross-Account Trust: Cross-account trust is a permission relationship that lets one account act in another account’s environment. It is usually implemented with roles, policies, or federation so a principal in one account can assume controlled access in a second account. This pattern reduces credential sharing, but it must be tightly scoped and monitored.
Deepen your knowledge
NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.
Published by the NHIMG editorial team on July 12, 2026.
Updated on October 13, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org