CrowdStrike’s SDNL acquisition exposes the authorization gap

At a glance

What this is: EnforceAuth argues that CrowdStrike’s SDNL acquisition puts a price tag on continuous authorization and highlights the gap between static access control and real-time decision governance.

Why it matters: IAM, NHI, and AI security teams need to separate identity provisioning from action authorization, because delegated and autonomous workflows can outpace review-based controls.

Context

Authorization is the decision layer that determines whether a specific action should proceed, not just whether an identity exists or has a role. In this article, the problem space is the gap between static IAM models and real-time decisions made across human, machine, and AI agent identities.

EnforceAuth frames CrowdStrike’s SDNL acquisition as evidence that authorization is now a budgeted category rather than a feature hidden inside access management. The central governance issue is whether enterprises can evaluate actions continuously across delegation chains, regulatory context, and shifting runtime conditions.

For identity teams, the important shift is from periodic entitlement checks to contextual decision control. That shift affects NHI governance, agentic AI oversight, and any IAM programme still assuming that access review alone can keep pace with modern execution models.

Key questions

Q: Why does static RBAC fail for AI agents and machine identities?

A: Static RBAC fails because it assigns permission ahead of time, while agents and machine identities can change context, route through delegation chains, and execute actions that a role model cannot judge in real time. The gap is not just overprivilege. It is the inability to decide whether a specific action should proceed at that moment.

Q: When should organisations prioritise continuous authorization over access reviews?

A: Organisations should prioritise continuous authorization when the identity can act repeatedly inside a session, especially for AI agents, automation pipelines, or workloads that move across systems. Access reviews still matter for governance evidence, but they do not stop a harmful action that occurs before the next review cycle.

Q: What breaks when authorization is decided only at login or provisioning time?

A: The control breaks when the live request differs from the conditions assumed at login or provisioning. Tokens, roles, and approvals may all be correct in history but wrong for the current resource, context, or session state. That is how identity programmes end up with access that looks governed on paper but remains executable in production.

Q: What do organisations get wrong when they treat human, machine, and AI identities the same?

A: They apply one policy model to identities with very different lifecycles, behaviours, and evidence requirements. Human users, service accounts, and AI identities should not share the same review cadence or control assumptions. When they do, governance becomes broad but shallow, and the most risky access paths are usually the least visible.

Technical breakdown

Continuous authorization versus login-time access checks

Traditional IAM often evaluates permissions at login and then assumes the session remains valid until logout or timeout. Continuous authorization uses ongoing context signals, such as device trust, risk, or policy change, to re-evaluate access during the session itself. That matters when the subject is not just a human user but also a service, workload, or AI-driven process that can act repeatedly without returning to a login boundary. CAEP-style models shift the control point from authentication time to runtime decision time, which changes how entitlements, revocation, and audit evidence are handled.

Practical implication: treat session start as only the first control point and design for runtime re-evaluation.

Identity-centric authorization versus decision-centric authorization

Identity-centric authorization asks whether an identity may access a resource. Decision-centric authorization asks whether a specific action should happen now, given the resource, context, delegation path, and policy constraints. That distinction becomes material when an AI agent or automated workflow can chain multiple tool calls, cross multiple systems, and trigger side effects that are not visible in a simple role check. In that model, the core risk is not only overbroad access but also incorrectly approved actions inside an otherwise valid session. The article’s point is that static IAM is too coarse for those decision sequences.

Practical implication: move policy evaluation closer to the action, not just the identity or session.

Delegation chains and context-aware policy enforcement

Delegation chains create layered authority: one identity grants, another executes, and a third may inherit context from both. In multi-cloud and agentic environments, that chain can span humans, service accounts, APIs, and AI agents, which makes simple role assignment insufficient. Context-aware policy engines can inspect the action, the data involved, and the current operating conditions before allowing execution. This is less about broader access and more about proving that each delegated step still meets the organisation’s policy, compliance, and operational expectations.

Practical implication: map delegated authority paths and require policy checks at each execution step.

Threat narrative

Attacker objective: The objective is to turn legitimate identity and delegated access into actions that should not have been authorised in the first place.

1. Entry occurs when an identity, session, or delegated workflow is already valid, so the attacker or misused actor starts from legitimate access rather than obvious compromise.
2. Escalation happens when that valid access is used to execute actions outside the intended context, often by chaining permissions across systems or data boundaries.
3. Impact follows when the action itself, not the login event, produces the harmful outcome, such as unauthorised transfers, data exposure, or infrastructure changes.

Breaches seen in the wild

• JumpCloud breach 2023: North Korean hackers breached JumpCloud and abused its device commands framework against a few customers; all admin API keys were reset.
• AnyDesk breach 2024: Attackers compromised AnyDesk's production systems; it revoked its code signing certificate and reset all portal passwords. Stolen keys were reported.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Authorization has moved from a supporting control to the governance layer that now determines whether modern identity programmes remain defensible. When humans, workloads, and AI agents can all act inside the same runtime chain, role assignment alone no longer proves that a specific action was appropriate. The market’s willingness to pay for continuous authorization confirms that identity teams must separate access entitlement from action approval.

Static RBAC is structurally too coarse for delegated execution. RBAC answers who may enter a scope, but it does not reliably answer whether a particular action inside that scope should proceed in the moment. As more systems delegate authority across services and agents, the control problem shifts from defining roles to governing context, timing, and side effects. Practitioners should treat this as a design limitation, not a tuning issue.

Access review assumes privilege persists long enough to be reviewed, but agentic and machine workflows can create and consume authority inside a single execution path. That assumption was designed for slower human-paced governance cycles. It fails when a workload or agent requests, uses, and releases authority before a reviewer could ever observe a stable entitlement state. The implication is that certification alone cannot be the primary safety net for dynamic execution.

Vendor consolidation is turning authorization into a platform battleground, which changes procurement and architecture decisions for multi-vendor enterprises. When continuous authorization is absorbed into a larger security stack, standalone options narrow and ecosystem lock-in rises. That does not remove the need for independent governance, but it does force teams to ask whether their current security fabric can enforce consistent policy across heterogeneous environments. Practitioners should judge authorization by portability and decision coverage, not by suite gravity.

Decision-level governance is the right named concept for this market shift. The article is really describing a move from identity-centric approval to decision-level governance, where the question is whether a specific action is permitted under current context and policy. That concept matters because it frames the problem around runtime control, auditability, and regulatory defensibility. Teams should use that lens when evaluating how well their IAM, NHI, and AI governance models align to actual execution.

What this signals

Decision-level governance is becoming the practical boundary for identity programmes that must span humans, service accounts, and AI agents. If the control only answers who has access, it will miss the moment when an otherwise valid identity makes the wrong move.

Access review and RBAC still matter, but they are increasingly upstream controls rather than the final decision point. The programme question is whether policy can follow the action across delegation chains, not whether a role was assigned correctly at the start.

For practitioners

• Separate entitlement from action approval Review whether your IAM model only answers who may enter a system, or whether it also governs what a session may do once inside. For AI agents and machine identities, those are different control problems.
• Map delegation chains end to end Document how authority moves from human approver to service account, API token, workload, or agent, then identify where policy is never rechecked before execution.
• Shift policy checks toward runtime decisions Evaluate whether high-risk actions, especially data movement, infrastructure changes, or financial operations, are authorised at the moment of execution rather than only at sign-in.
• Reassess access review as a control Use recertification for governance evidence, but do not rely on it as the primary safeguard for ephemeral or continuously changing authority.
• Define where standalone authorization is required Identify domains where portable decision enforcement is needed across multiple platforms, especially in multi-cloud and heterogeneous security stacks.

Key takeaways

• The article frames authorization as a standalone governance layer, not a feature hidden inside IAM or endpoint tooling.
• Its core risk is valid access being used for invalid actions, especially across delegated human, machine, and AI execution paths.
• Practitioners should move high-risk policy checks closer to runtime decisions and treat access review as supporting evidence, not the only safeguard.

Key terms

• Decision-centric authorization: Decision-centric authorization is a governance model that evaluates each action before it happens, using identity, context, and policy together. For autonomous or machine-speed actors, it is more reliable than static access grants because it tracks behaviour as it unfolds.
• Continuous authorization: Continuous authorization is the practice of rechecking access as a session unfolds instead of trusting a single login decision. It matters for AI workflows because the request, context, retrieved data, and downstream action can all change between prompt and execution, making static approval too blunt.
• Delegation Chain: A delegation chain is the sequence of identities, credentials, and tool calls an agent uses to complete a task across systems. It matters because each step may appear acceptable on its own while the combined path produces an outcome no reviewer would have approved directly.
• Identity-Based Authorization: Identity-based authorization grants access based on verified identity attributes instead of network location. For remote devices, that means labels such as customer, region, or lifecycle state can control access even when the underlying transport changes.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.