TL;DR: Most identity governance programmes still rely on periodic reviews, even though access changes daily and blind spots persist across disconnected systems, non-human identities, physical access, and orphaned accounts, according to Gathid. The real failure is not the tool stack but the absence of continuous visibility into who has access to what and why.
At a glance
What this is: This article argues that identity governance breaks down when organisations rely on periodic reviews instead of continuous visibility into access changes, exceptions, and non-human identities.
Why it matters: It matters because IAM and IGA teams cannot credibly assure access risk, SoD, or board-level accountability if governance only proves a point in time rather than daily identity reality.
Context
Identity governance is the set of processes that answers a basic question: who has access to what, why, and whether that access is still justified. The article argues that many programmes still answer it on a schedule rather than continuously, which leaves blind spots between review cycles.
That gap shows up across disconnected systems, non-human identities, physical access, orphaned accounts and weak contextual identity. The result is not a tooling shortage so much as a governance model that cannot keep pace with daily access change, even in mature environments.
Key questions
Q: What breaks when identity governance relies only on access reviews?
A: Access reviews assume the reviewable state is a stable entitlement that reflects real risk. In fast-moving cloud and agentic environments, the risky state may have already changed by the time the review runs. Teams then certify a snapshot instead of governing the behaviour that creates exposure.
Q: Why do disconnected identity stores create governance risk?
A: Disconnected stores create multiple versions of identity truth, which leads to duplicated effort, stale entitlements, and inconsistent accountability. That risk grows when the estate includes contractors, service accounts, and AI agents, because each population may be tracked in a different system with different quality controls.
Q: How can teams tell whether access governance is actually working?
A: Look for short revocation times, low rates of stale entitlements, and repeatable access review outcomes across systems. If accounts remain active after role changes or offboarding, governance is not effective. Good measurement focuses on whether access is removed when it stops being justified.
Q: How should teams govern service accounts and bots alongside human users?
A: Treat service accounts, bots, and other non-human identities as owned assets with explicit purpose, review, and retirement rules. They need the same lifecycle discipline as human identities, but with tighter inventory, stronger change tracking, and clearer accountability because they are often more persistent and less visible.
Technical breakdown
Why periodic access reviews miss daily identity drift
Periodic access reviews are designed to certify a snapshot of entitlements at a point in time. That works only if access changes slowly enough for the review cycle to capture it before the next material change. In practice, access drifts across applications, directories and manual exceptions long before quarterly or annual certification completes. The problem is not merely incomplete data. It is that the governance model assumes the state being reviewed remains stable long enough to be meaningful, while real identity conditions mutate daily. Practical implication: review cadence alone cannot serve as the control plane for ongoing access assurance.
Practical implication: move from point-in-time certification to continuous entitlement visibility across the systems that actually change access.
How disconnected systems and non-human identities widen the governance gap
Disconnected systems break the chain of evidence that identity governance needs. When cloud apps, legacy platforms, physical access and service accounts are managed in different silos, no single review can show whether access is consistent with policy or role context. Non-human identities make that harder because they often have no business owner in the same sense as a person, yet still hold standing access, tokens, or automation permissions. Governance therefore needs to reason across human and non-human entitlements, not just user accounts. Practical implication: inventory and correlate every access domain that can grant authority, including service accounts, bots and separately governed physical access.
Practical implication: unify identity context across human and non-human access domains before expecting recertification to mean anything.
What contextual identity adds to access governance
Contextual identity links access back to real-world attributes such as role, department, location or employment status. Without that context, a reviewer may see that access exists but not whether it still fits the current business need. This is why policy violations and toxic combinations can persist undetected between reviews even when the underlying tools are present. Context is what lets governance decide whether access is appropriate, not just whether it exists. Practical implication: enrich identity data so access can be evaluated against business context, not merely against static entitlements.
Practical implication: enrich identity records with role and employment context so access decisions can be evaluated against current business reality.
Breaches seen in the wild
- Okta support system breach 2023: A support service account credential saved in a personal Google profile let attackers take HAR files and hijack five Okta customers' sessions.
- Cloudflare Thanksgiving breach 2023: One service token and three service accounts left unrotated after the Okta breach gave a nation-state attacker access to Cloudflare's Atlassian systems.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Daily governance, not periodic certification, is the real control boundary. The article correctly identifies that access risk changes faster than many certification cycles. That means the governance question is no longer whether reviews exist, but whether they can observe identity state while it is still actionable. Practitioners should treat continuous visibility as the baseline for assurance, not a nice-to-have add-on.
Non-human identities are part of the same governance problem, not a separate side case. Service accounts and bots sit inside the same access model as users, yet many programmes still govern them with different processes or no lifecycle discipline at all. That separation creates blind spots in ownership, review, and exception handling. The practical conclusion is that identity governance has to span human and machine access as one operating model.
Contextual identity is what makes governance prove something, not just collect attestations. A review list without role, department, or status context tells you who appears to have access, but not whether that access is still justified. That weakens auditability and leaves policy violations hidden between review events. Practitioners should regard context enrichment as a governance requirement, not a data quality nicety.
Identity trust debt: when organisations defer continuous governance, they accumulate unresolved access uncertainty that compounds across systems and identity types. The longer access state remains unobserved, the harder it becomes to separate legitimate change from policy drift. This is the point where governance maturity becomes measurable by how quickly teams can reconcile access reality, not by how many reviews they schedule.
From our research library:
- Nearly 60% of IT leaders cite restrictive cost and complexity as a weakness of legacy identity governance, according to the 2025 State of Identity Governance Report.
What this signals
Periodic reviews are still useful, but they are no longer sufficient as the primary proof of identity control. The programme design question now is whether governance can keep pace with daily access change across cloud apps, legacy systems, service accounts and physical access.
Identity trust debt: the longer teams wait for the next certification cycle, the more unobserved access drift compounds across the environment. That debt shows up first as weak evidence, then as unresolved exceptions, and finally as governance that can no longer answer simple audit questions with confidence.
For practitioners
- Implement continuous access visibility Establish a control layer that can surface entitlement changes daily across directories, SaaS apps, legacy platforms and physical access systems. Treat certification as a confirmation step, not the primary source of truth.
- Map non-human identities into governance workflows Inventory service accounts, bots and automation credentials alongside user accounts, then assign ownership, review cadence and offboarding responsibility for each.
- Add contextual identity attributes Attach role, department, location and employment status to identity records so reviewers can evaluate whether access still fits business need.
- Prioritise orphaned and policy-violating access Target accounts that fall outside normal ownership, have no clear business context, or remain active after the last meaningful change event.
Key takeaways
- Periodic access reviews leave blind spots that let identity drift, orphaned accounts and policy violations persist between certifications.
- The governance gap is broader than user accounts because it spans disconnected systems, non-human identities and separately managed physical access.
- Continuous visibility and contextual identity data are the controls that turn access governance from a snapshot into an operational assurance process.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 addresses the attack and risk surface, while NIST CSF 2.0, CIS Controls v8 and NIST Zero Trust (SP 800-207) set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-01 — Improper Offboarding | Orphaned accounts and unmanaged lifecycle gaps are central to the article's governance failure. |
| NHI-05 — Overprivileged NHI | The article highlights standing access and policy drift across service accounts and bots. | |
| Recommendation — Review offboarding coverage for every identity type and close gaps that leave accounts active after role or ownership change. Reassess NHI privilege scope and reduce standing access that exceeds current business need. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | The core issue is whether permissions and entitlements remain accurate between reviews. |
| Recommendation — Validate entitlement accuracy continuously and not only during scheduled certification cycles. | ||
| CIS Controls v8 | CIS-5 — Account Management | The article focuses on account ownership, orphaned accounts, and lifecycle governance. |
| Recommendation — Centralise account ownership and reconcile orphaned accounts before they become governance blind spots. | ||
| NIST Zero Trust (SP 800-207) | Continuous verification — Continuous verification | Daily confidence depends on continuous validation rather than periodic trust decisions. |
| Recommendation — Apply continuous verification to access decisions so entitlement state is checked as conditions change. | ||
Key terms
- Identity Drift: Identity drift is the gap between the access path originally approved and the behavior that exists later. For browser extensions, drift can appear through updates, remote configuration, publisher changes, or permission expansion, turning a trusted integration into a materially different risk.
- Contextual Identity: Contextual identity is identity data enriched with business information such as employment status, department, role, and accountable owner. It improves governance decisions by linking entitlements to real operating context, which is especially important when contractors, third parties, and non-human identities are involved.
- Orphaned Account: An orphaned account is an identity that remains active without a clear owner or business purpose. These accounts are dangerous because they often escape review, retain unnecessary access, and provide attackers with low-friction entry points into otherwise governed environments.
- Continuous visibility: The ability to observe control operation, exceptions, and remediation as they happen across systems. In identity and governance programmes, continuous visibility means teams can trace who approved what, what changed, and whether the control actually executed without waiting for a later review cycle.
Deepen your knowledge
NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.
Published by the NHIMG editorial team on June 11, 2026.
Updated on October 10, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org