TL;DR: Identity governance breaks down when IGA only covers connected systems, leaving on-prem apps, homegrown databases, service accounts and AI agents to be handled by hand and certified from an incomplete picture, according to Oak. Coverage, not workflow, becomes the real control boundary when access reviews and least privilege depend on what the programme can actually see.
At a glance
What this is: Oak says identity governance loses accuracy when systems, service accounts and AI agents sit outside the connected estate and remain governed through manual work.
Why it matters: IAM, IGA and NHI teams need full coverage before reviews, risk scoring and remediation can be trusted, because partial integration turns governance into an incomplete view of access.
Context
Identity governance only works when the programme can connect the systems that hold access data. When coverage stops at the easy integrations, reviewers see an incomplete estate and the organisation starts certifying access without full evidence.
This article is about the governance gap created by partial integration across cloud, SaaS, on-prem and homegrown systems. It also extends to non-human identities and AI agents, because both are left outside the picture when they do not map cleanly into the identity programme.
Oak's core claim is that coverage is a precondition for identity governance, not a later optimisation. Once systems remain unconnected, the programme still runs, but it runs on manual exceptions and partial facts.
Key questions
Q: What breaks when identity governance cannot reach legacy and core systems?
A: Access reviews, entitlement discovery, and compliance evidence all become partial. The programme may still operate for modern cloud apps, but the most sensitive systems remain outside its control. That gap creates unmanaged risk, delayed remediation, and audit findings that are harder to defend.
Q: Why does incomplete coverage create security risk as well as governance drift?
A: Because attackers do not care which systems are integrated, and the unconnected application with a stale admin account is often the easiest path in. Missing coverage means the programme cannot see, review or remediate those privileges with confidence. The security problem is not the connector backlog itself, but the exposure that backlog leaves behind.
Q: Why do service accounts and AI agents need different controls from human users?
A: Service accounts and AI agents authenticate and act without the predictable patterns that human identity systems expect. They can operate across runtimes, scale quickly, and carry permissions into automated workflows. That means access decisions should consider workload context, runtime behaviour, and time-bound authority rather than relying only on user-centric IAM patterns.
Q: Should organisations prioritise connector coverage before expanding access reviews?
A: Yes. Access reviews only become meaningful when the programme can see the systems, entitlements and usage context that make a certification decision defensible. Expanding review volume before coverage creates more activity, not better governance, because the same blind spots remain in place.
Technical breakdown
Why partial integration distorts access reviews
Identity governance tools can only certify what they can see. If a system is missing from the connector set, its entitlements, last-use data and resource context are absent from the reviewer’s evidence set, so the review measures process completion rather than actual risk reduction. This is not just a tooling inconvenience. It changes the semantics of certification, because the review result now reflects a partial inventory rather than the full access estate. When service accounts, direct application grants and out-of-band permissions are excluded, the control begins to report confidence where only coverage exists.
Practical implication: Treat connector coverage as part of the control design for access reviews, not as an implementation detail.
How write-back changes identity remediation
Read-only visibility tells you what is wrong, but it does not close the loop. A governance layer that can identify excess access yet cannot downsize it at the source still depends on tickets, handoffs and delayed closure. The technical distinction here is between discovery and enforcement: discovery builds evidence, enforcement changes state. In practice, that difference determines whether identity risk is reduced in the target system or merely documented in a workflow tool. Write-back matters because it keeps entitlement correction tied to the system of record instead of to a downstream manual queue.
Practical implication: Prioritise remediation paths that can modify source entitlements directly, with approval and audit evidence preserved.
Why AI agents and service accounts expand the coverage problem
Manual identity governance assumes the estate is mostly human and mostly mapped to HR, but that assumption no longer holds. Service accounts, workload identities and AI agents often lack the stable organisational anchor that makes person-based governance straightforward. They can exist outside joiner-mover-leaver patterns, be created in local tools, and persist without a named business owner. That creates a coverage problem and an ownership problem at the same time. If the identity programme only models people, then the non-human layer is visible in operations but invisible in governance, which leaves a large part of access unmanaged.
Practical implication: Build a separate inventory and ownership model for non-human identities and AI agents instead of forcing them through HR-based workflows.
NHI Mgmt Group analysis
Coverage is the real control boundary, not the IGA licence line. Identity programmes often behave as though governance starts once the tool is in place, but the article shows the opposite. If a system is not connected, the programme is effectively blind to it, even if policy says it is in scope. That makes coverage a governance primitive, not a deployment milestone. Practitioners should treat connector completeness as a board-relevant control condition, because every unconnected system is a decision domain outside the evidence chain.
Manual exception handling creates a shadow governance model. Spreadsheets, tickets and exports are not harmless stopgaps; they become the de facto system of record for the identities the platform cannot reach. Over time, that shadow process can diverge from the formal programme, especially where service accounts, direct grants and homegrown applications accumulate. The result is not simply slower administration. It is inconsistent certification logic across different parts of the estate, which undermines audit defensibility and operational trust.
Non-human identities expose the limits of person-centric governance. The article correctly points to service accounts and AI agents as identities that do not map neatly to HR, and that is the deeper issue. Person-based lifecycle assumptions do not automatically extend to workloads or agents, so visibility and ownership have to be established differently. This is where NHI governance stops being a niche concern and becomes core identity architecture. Practitioners should separate human lifecycle design from machine and agent governance rather than forcing one model to do all three.
Read coverage as a prerequisite for least privilege, not a by-product of it. Least privilege can only be measured when granted access, used access and reachable resources are all visible in the same control plane. If half the estate is absent, the programme may still issue reports, but it cannot credibly say what should be removed. That means identity risk management starts with completeness of inventory and connectivity. Teams that want measurable least privilege need to fund coverage before they expect policy outcomes.
From our research library:
- Only 5.7% of organisations have full visibility into their service accounts, according to the Ultimate Guide to NHIs.
- Read next: IGA Buyer's Guide
What this signals
Coverage debt: identity programmes accumulate a hidden governance gap whenever systems, service accounts or agents sit outside the connector set. Once that happens, manual work becomes the operating model and least privilege turns into an approximation rather than a measured control.
Only 5.7% of organisations have full visibility into their service accounts, according to the Ultimate Guide to NHIs. That is why non-human identity governance cannot be treated as a side project to human IAM.
For practitioners
- Map connector coverage against the full identity estate Inventory cloud, SaaS, on-prem, homegrown and file-based sources, then compare that list with what the IGA can currently read. The gap is the part of the estate where governance is still manual.
- Add non-human identities to the governance model Create explicit ownership and lifecycle handling for service accounts, workload identities and AI agents so they are not left to spreadsheet control or ad hoc review.
- Prioritise write-back for remediation Where the platform can identify excess access, make sure it can also push approved changes into the source system rather than exporting remediation to a ticket queue.
- Use review evidence to test coverage quality Check whether reviewers can see last use, sensitivity and resource context on each entitlement row. If they cannot, the access review is still partial even if it is completed on schedule.
Key takeaways
- Identity governance loses force when the programme can only govern connected systems, because partial coverage turns certification into an incomplete exercise.
- The article ties coverage gaps to manual handling, stale access and blind spots across service accounts, homegrown applications and AI agents.
- Practitioners need complete visibility and source-system remediation before they can trust reviews, least privilege reporting or audit evidence.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 and MITRE ATT&CK address the attack and risk surface, while NIST CSF 2.0 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-01 — Improper Offboarding | Uncovered identities often persist because the programme never fully owns their lifecycle. |
| NHI-05 — Overprivileged NHI | Partial visibility leaves excess NHI access unreviewed and untrimmed. | |
| Recommendation — Map unconnected NHIs to NHI-01 and close lifecycle gaps where identities outlive the systems that created them. Use NHI-05 to reduce entitlement scope where access cannot be justified by current usage. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | The article is about governing who can access what across a fragmented estate. |
| Recommendation — Apply PR.AA-05 to make entitlement coverage complete before trusting certification outcomes. | ||
| CIS Controls v8 | CIS-5 — Account Management | The article focuses on missing identities and accounts outside central governance. |
| Recommendation — Use CIS-5 to inventory and manage accounts that sit outside the main identity workflow. | ||
| MITRE ATT&CK | TA0007;TA0008 — Discovery; Lateral Movement | The article notes attackers exploit unreviewed, unconnected systems as easy entry paths. |
| Recommendation — Map unconnected systems to TA0007 and TA0008 to prioritise exposed accounts and paths. | ||
Key terms
- Coverage debt: Coverage debt is the gap between the assets a security platform should see and the assets it actually covers at a point in time. It grows when deployment, maintenance, or configuration work cannot keep pace with cloud churn, leaving risk visible only after the gap has already formed.
- Shadow Governance: Shadow governance is the condition where a tool, workflow, or AI capability affects access or data handling without a formal owner, policy boundary, or review path. It usually emerges when adoption moves faster than identity, logging, and approval controls can describe the activity.
- Non-Human Identity (NHI): A digital identity assigned to a non-human entity such as a software application, service account, API key, bot, machine, or AI agent that enables it to authenticate and interact with systems without direct human involvement. NHIs now outnumber human identities in most enterprises by 25 to 50 times.
- Write-back Remediation: Write-back remediation is the ability to push an access decision back into the target system so the entitlement is actually changed, not just reported. It matters because governance without execution leaves review findings, revocation decisions, and offboarding tasks unresolved.
Deepen your knowledge
NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.
Published by the NHIMG editorial team on October 16, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org