C1.ai’s crawl, walk, run model exposes identity governance gaps

At a glance

What this is: This article lays out a crawl, walk, run maturity model for identity security and argues that most organisations are still struggling with visibility, least privilege, and runtime governance across both human and non-human identities.

Why it matters: IAM, IGA, and NHI teams should treat identity visibility, access rationalisation, and automated governance as a single programme, because gaps in one layer quickly undermine the others.

👉 Read C1.ai's analysis of the crawl, walk, run model for identity security

Context

Identity governance fails when organisations cannot inventory who and what has access, where that access lives, or whether it still makes sense. That problem now spans human users, contractors, groups, API tokens, service accounts, and certificates, so identity programmes that still treat these as separate operating tracks miss the real control gap.

The article uses a crawl, walk, run model to describe maturity, but the underlying message is simpler: discovery comes before control, baseline policy comes before automation, and runtime governance is what closes the gap between static permissions and changing operational reality. For IAM and NHI teams, the question is no longer whether to govern machine identities, but whether the governance model can keep pace with how fast those identities are created and used.

Key questions

Q: Where do identity governance programmes fail first in on-prem environments?

A: They fail where the programme depends on direct cloud-to-private-network reach. If visibility requires inbound access, firewall changes, or network exceptions, many teams will not allow it, and the affected systems remain outside review, logging, and audit coverage.

Q: Why do least privilege programmes break down in real environments?

A: They usually break because access is copied, inherited, or left in place after a role change. Group sprawl and stale entitlements hide the real privilege state, so the programme looks controlled on paper while actual access keeps expanding in practice.

Q: How should security teams govern non-human identities at scale?

A: Security teams should treat non-human identities as a lifecycle problem with ownership, review, rotation, and revocation built in from the start. Inventory is necessary but insufficient. The control objective is to ensure every service account, token, or automation identity has a clear purpose, a bounded scope, and a reliable offboarding path when it is no longer needed.

Q: What does runtime governance add that periodic access review does not?

A: Runtime governance responds when access changes, rather than waiting for a review cycle to notice the problem. It is the difference between seeing stale access after it has already accumulated and controlling access while it is being created or modified.

Technical breakdown

Why visibility is the first control boundary

Identity security starts with knowing what exists. In practice, that means building a single inventory across users, groups, roles, permissions, API tokens, service accounts, certificates, and connected applications so that access is no longer spread across separate tools and spreadsheets. Without that baseline, every other control becomes partial because you cannot review, rationalise, or retire identities you cannot enumerate. The article’s crawl phase is really an identity source-of-record problem: if the inventory is incomplete, risk stays hidden until it becomes operational damage.

Practical implication: establish one authoritative identity inventory before trying to optimise access policy or governance automation.

How least privilege breaks under group sprawl and copy-forward access

Least privilege fails when access is assigned by habit rather than by policy. The article describes common patterns such as copying another employee’s permissions, leaving old access in place after role changes, and letting groups accumulate members and entitlements until nobody can explain their purpose. That is not just a hygiene issue. It creates durable over-permissioning because inherited access becomes the default mechanism for speed, while revocation becomes the exception. In governance terms, the control weakens when entitlement provenance is lost and no one owns cleanup.

Practical implication: rationalise groups and role assignments by ownership and business need, then remove inherited access that no longer has a clear justification.

Why NHI governance becomes the decisive maturity test

Non-human identities are no longer edge cases. API tokens, service accounts, and certificates operate with real privileges inside production systems, and the article notes that they already outnumber humans 20:1. That scale changes governance because machine identities often outlive the workflows that created them, while expiry, rotation, and scope are rarely tracked with the same discipline as human joiner-mover-leaver processes. The next pressure point is agentic AI, which pushes the same problem further by adding autonomous actors that must be onboarded, governed, and offboarded like first-class identities.

Practical implication: extend lifecycle, ownership, and access review controls to machine identities and prepare governance models for AI agents before they proliferate.

Threat narrative

Attacker objective: The attacker objective is to exploit hidden or excessive access paths to reach critical systems while remaining inside the organisation's incomplete identity view.

1. entry via unmanaged identity sprawl, where unknown users, tokens, and service accounts remain outside the control baseline.
2. credential access through over-permissioned accounts, stale group membership, and copied access that no one has reviewed.
3. escalation through governance failure, because missing revocation, weak ownership, and opaque group structures preserve access beyond its intended scope.
4. impact through durable exposure of critical systems, compliance gaps, and an access environment that cannot be confidently remediated.

NHI Mgmt Group analysis

Identity visibility is now the foundation layer of governance, not a reporting feature. The crawl phase captures the real control problem: organisations cannot govern access they cannot enumerate. That applies equally to humans, NHIs, and emerging AI agents, because the inventory is the prerequisite for every downstream decision. The practitioner conclusion is straightforward: identity programmes that lack complete discovery are still operating blind.

Least privilege breaks when access is inherited faster than it is understood. Copy-forward permissions, stale group membership, and role drift turn access into a legacy structure rather than a governed one. The article shows that the failure is not theoretical; it is embedded in day-to-day administration. The practitioner conclusion is to treat entitlement provenance as a control objective, not just an audit concern.

Non-human identity governance is the maturity test that separates static IGA from actual runtime governance. The article's 20:1 NHI ratio makes clear that machine identities are no longer peripheral to identity strategy. Their lifecycle, expiry, rotation, and ownership problems are structurally different from human access, and AI agents will intensify that gap because they create a new class of identity that must be onboarded and offboarded like a worker. The practitioner conclusion is to govern NHIs as core production identities, not as an operational afterthought.

Automated and contextual access control is the only model that can survive current identity scale. Static policies cannot keep pace when permissions, tokens, and access paths change continuously across cloud and on-prem environments. That is why the article’s run phase matters: real-time governance is where identity security stops being a periodic review process and becomes an operating control. The practitioner conclusion is to move governance decisions closer to issuance and change events.

What this signals

Identity governance has crossed from administration into resilience. When users, NHIs, and soon AI agents all depend on the same access fabric, programmes built around periodic review alone will keep lagging behind operational change. The practical shift is toward governance that observes identity state continuously instead of auditing it after the fact.

Non-human identities are now the pressure point that exposes whether an IAM programme is mature. If teams cannot answer who owns a token, when a certificate expires, or why a service account still has access, they do not have an NHI programme, they have an inventory gap. The next maturity step is not more documentation, but tighter lifecycle enforcement across the identity estate.

For practitioners

• Build a single identity inventory Aggregate users, groups, roles, permissions, API tokens, service accounts, certificates, and applications into one authoritative record. Without that baseline, access review and remediation programmes will keep missing hidden entitlements.
• Rationalise group-based access Review groups for unclear ownership, stale membership, and inherited permissions that no longer map to business need. Remove or redesign groups that exist only to preserve fragile legacy access paths.
• Extend governance to NHIs Assign owners, lifecycle status, expiry, and rotation expectations to tokens, service accounts, and certificates. Treat them as governed identities rather than unmanaged infrastructure artefacts.
• Move to runtime governance Use contextual and policy-based access decisions for high-risk changes instead of relying on static grants and periodic reviews alone. Prioritise controls that respond when access is created, changed, or no longer needed.

Key takeaways

• The article argues that identity risk starts with unknown and unmanaged access, not with a single weak control.
• Its maturity model places discovery, baseline controls, and runtime governance in a sequence that many organisations have not yet completed.
• The clearest operational lesson is to govern NHIs and human access through one identity model, not separate silos.

Key terms

• Identity Source of Record: An identity source of record is the system that should define and reconcile the organisation’s view of access. For shadow access, the challenge is that the source of record often excludes in-app grants, so the real entitlement state diverges from governance data.
• Entitlement Drift: Entitlement drift is the slow accumulation of permissions that no longer match the original purpose, role, or workload. In cloud-native and NHI-heavy environments, it usually happens because access changes faster than review cycles, leaving organizations with more privilege than they intended.
• Runtime Governance: Runtime governance is the set of controls that verify what a system or agent is actually doing after deployment. It combines monitoring, authorization checks, and access validation so teams can detect drift, misuse, or excessive privilege in motion rather than assuming build-time policy still holds.
• Non-Human Identity Lifecycle: The Non-Human Identity Lifecycle is the full sequence of creation, use, control, review, and retirement for identities that are not tied to a person. It covers service accounts, API keys, certificates, tokens, bots, and AI agents, including issuance, rotation, monitoring, revocation, and secure decommissioning across systems and environments.

What's in the full article

C1.ai's full blog covers the operational detail this post intentionally leaves for the source:

• The crawl, walk, run maturity framing as presented by the vendor, including how each stage maps to identity programme scope.
• Examples of the baseline controls discussed for onboarding, access reviews, self-service requests, and role rationalisation.
• The vendor's description of contextual and automated governance for users, NHIs, and applications across cloud and on-prem environments.
• The operational positioning behind its unified control plane approach for identity visibility and access management.

👉 The full C1.ai post expands on identity visibility, baseline controls, and runtime governance across users and NHIs.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity security are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.