Continuous identity state is replacing lifecycle-only IAM models

At a glance

What this is: NHI Mgmt Group's analysis, drawing on Fischer Identity's blog post: Event-driven identity administration is being replaced by continuous identity state to keep access aligned with current relationships, ownership, policy, and risk.

Why it matters: It matters because IAM and IGA teams must govern identities that change between reviews, including service accounts, contractors, students, vendors, and AI agents, not just employees moving through hire, transfer, and leave events.

Context

Lifecycle-based IAM works best when identity changes are clean, infrequent, and easy to map to a single business event. The problem in modern environments is that relationships, sponsorship, ownership, and access can change without a clean joiner-mover-leaver trigger, so identity state drifts away from reality.

Fischer Identity's article argues that the control gap is not speed of processing but freshness of state. In higher education and other complex organisations, the identity subject may be a person, a contractor, a student, a vendor, a service account, or an AI agent, and each needs current governance rather than periodic correction.

The key governance question is therefore not whether lifecycle events matter. They do. The question is whether periodic events alone can keep access justified when multiple relationships, temporary access, overlapping roles, and non-human identities all coexist in the same programme.

Key questions

Q: What breaks when device lifecycle management is not tied to identity governance?

A: When device lifecycle management is isolated from identity governance, organisations lose the ability to prove who used the device, what access it carried, and whether retirement actually removed trust. That creates residual access risk through cached credentials, retained software permissions, and incomplete offboarding. The control failure is usually not the asset record itself, but the missing link between device state and identity state.

Q: When should organisations prioritise continuous identity evidence over quarterly access reviews?

A: Prioritise continuous evidence when identities change frequently, access is delegated across cloud and SaaS, or auditors need proof of control operation rather than policy intent. Quarterly reviews can still exist, but they should consume live evidence, not replace it. Continuous control is especially important where NHIs and AI agents can alter access faster than human review cycles.

Q: What are the signs that identity state is drifting out of sync?

A: Look for accounts with expired sponsors, access that no longer matches current role or status, repeated extensions, unresolved ownership, and identities that have changed relationship without corresponding entitlement updates. Those patterns show that state is being inferred from old events instead of current context.

Q: Why do service accounts and AI agents need different controls from human users?

A: Service accounts and AI agents authenticate and act without the predictable patterns that human identity systems expect. They can operate across runtimes, scale quickly, and carry permissions into automated workflows. That means access decisions should consider workload context, runtime behaviour, and time-bound authority rather than relying only on user-centric IAM patterns.

Technical breakdown

Why lifecycle events miss identity drift

Lifecycle events are discrete triggers such as hire, transfer, termination, account creation, or role change. They are useful because they map business events to access actions, but they assume the next trigger will arrive soon enough to keep the record accurate. In practice, that assumption fails when access outlives the event that justified it, when ownership changes without formal offboarding, or when an identity accumulates new rights across multiple systems. The technical issue is not provisioning itself but the gap between state changes and the next review or workflow execution.

Practical implication: treat lifecycle events as inputs to governance, not as proof that identity state is still correct.

How relationship state should drive access state

A continuous identity model ties access to the current relationship that justifies it, not just to the original onboarding event. An employee, contractor, student, vendor, service account, or AI agent may each have a different relationship state, sponsor, duration, and policy boundary. When that relationship changes, the access profile should change with it. This is especially important where multiple relationships overlap, because a person or non-human identity may have one access set for one relationship and a different one for another. Continuous identity state is therefore a control model for context, not just records.

Practical implication: model access around relationship state so entitlement decisions can change when business context changes.

Why continuous governance needs stronger signals

Continuous identity state depends on signals from HR, student systems, contractors, application owners, ticketing, risk engines, and activity data. Those signals matter only if they are translated into governed action such as approval, review, transition, or removal. The technical failure mode in event-only IAM is not the absence of data; it is the absence of a control layer that can interpret new signals continuously. Without that layer, periodic certifications become retrospective checks that cannot keep pace with daily relationship changes, especially in mixed human and non-human populations.

Practical implication: define which signals trigger governance action and automate the decision path before identity state drifts.

NHI Mgmt Group analysis

Continuous identity state is a governance model, not a workflow enhancement. Event processing is still necessary, but it is no longer sufficient to preserve identity accuracy in environments where relationships change outside the cadence of formal lifecycle triggers. The operational problem is drift between what the system last knew and what the business relationship now justifies. Practitioners should stop treating lifecycle completion as the end state and start treating it as a checkpoint.

The old assumption was that access could be certified after it had already existed for a while. That assumption works when identity changes are slow and review cycles are close enough to catch error. It fails when access can expand, overlap, or expire between review windows, which is common in modern hybrid estates. The implication is that governance must be state-aware at the moment the relationship changes, not only at review time.

Continuous identity state is the natural successor to joiner-mover-leaver thinking in mixed identity estates. The article correctly shows that workforce IAM patterns no longer cover students, guests, vendors, service accounts, workloads, bots, and AI agents with enough fidelity. That shift makes relationship-aware control the real organising principle for IGA. Practitioners should expect identity programmes to be measured by how accurately they track current state, not by how quickly they process tickets.

Identity governance now has to manage ownership, sponsorship, and purpose as first-class control points. This is the part many programmes miss when they focus only on provisioning and deprovisioning. If a service account, contractor, or AI agent still has access but its owner, sponsor, or approved purpose has changed, the state is already wrong. The practical conclusion is that continuous identity is about preserving accountability as much as access.

What this signals

Continuous identity state reframes IGA from a periodic clean-up exercise into a live control model. For programmes that still depend on quarterly certifications and delayed offboarding, the practical issue is not more automation of the old model but a different source of truth for identity state. Governance has to follow current relationship, sponsorship, and purpose, or it will always trail the business reality it is meant to control.

Relationship-aware access is now the more durable design pattern for mixed estates. Once service accounts, students, contractors, vendors, and AI agents all sit inside the same identity fabric, lifecycle-only logic becomes too coarse to govern accurately. Teams should expect the next maturity step to be continuous evaluation of whether current access still matches current context.

For practitioners

• Define current identity state as a governed object Map each identity to current relationship, ownership, sponsorship, access, policy, and risk so governance can evaluate state instead of only events.
• Trigger governance on relationship change Create review, approval, or removal paths that fire when a contractor ends, a role changes, a sponsor lapses, or an AI agent expands scope.
• Model non-human identities separately Treat service accounts, workloads, bots, and AI agents as distinct governed populations with purpose, owner, and lifecycle state, not as exceptions to workforce IAM.

Key takeaways

• Lifecycle-only IAM breaks down when identity relationships change faster than the next scheduled trigger or review.
• The article's core risk is identity drift, where access, ownership, and policy no longer match the current business relationship.
• Practitioners should move governance closer to state change so access is evaluated continuously, not just after onboarding or offboarding events.

Key terms

• Continuous Identity: A governance model that turns identity data into live access decisions. Instead of relying on static approvals and periodic reviews, continuous identity reevaluates whether access should still exist based on current context such as risk, device state, ticket status, or business need.
• Identity Drift: Identity drift is the gap between the access path originally approved and the behavior that exists later. For browser extensions, drift can appear through updates, remote configuration, publisher changes, or permission expansion, turning a trusted integration into a materially different risk.
• Relationship State: The active status that determines what a person or account should be allowed to do at a given moment. In practice, this includes source of authority, ownership, purpose, and duration, so governance can adjust access when the relationship changes instead of after manual review.
• Governed Identity State: An identity posture that is continuously evaluated against policy, ownership, and current context instead of being assumed correct after a one-time provisioning action. It gives IAM and IGA teams a control point for change, exception handling, and timely access correction.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.