TL;DR: Clarity Security says the Enterprise Access Model helps answer who should hold tier 0 and tier 1 access, but nested trusts, federated permissions and unmanaged application accounts can leave 30% of access outside typical controls. Identity governance fails when the programme cannot see the full access graph, not when the tiering concept is wrong.
At a glance
What this is: This analysis explains how enterprise access tiers help frame governance, while nested trusts, federated paths and unmanaged accounts still create blind spots in tier 0 and tier 1 access decisions.
Why it matters: IAM, PAM and IGA teams need to govern actual access paths, not just nominal roles, because hidden trusts and cross-boundary permissions can bypass the intended tier model.
By the numbers:
- Clarity Security has found 30% of all access is nested or federated through trusts and outside the scope of typical controls.
👉 Read Clarity Security's analysis of enterprise access model governance gaps in tier 0 and tier 1
Context
The Enterprise Access Model is a governance lens for privileged access, not a discovery system. It helps define who should hold tier 0 and tier 1 access, but it does not automatically expose every nested trust, delegated permission or unmanaged account already in place.
That gap matters because access models fail in practice when identity governance assumes the directory or IdP is the full source of truth. In mixed environments, application-local accounts, cross-forest trusts, federated paths and cloud account linkages can carry privilege that never shows up cleanly in standard review workflows.
Key questions
Q: What breaks when enterprise access tiers do not include nested and federated permissions?
A: Governance breaks when reviews only cover direct assignments and miss the access paths that actually confer control. Nested trusts, federated links and application-local accounts can give a user effective tier 0 or tier 1 power while the review record still looks narrow. That creates false assurance and leaves privilege escalation paths ungoverned.
Q: Why do hidden trusts increase the risk of privileged access?
A: Hidden trusts expand effective privilege because they let one identity inherit or traverse access through another boundary without appearing as a simple role grant. That makes least privilege hard to prove and harder to certify, especially when the trust is legacy, cross-forest or cloud-linked. The risk is not the trust itself, but the unreviewed authority it exposes.
Q: How can teams tell whether tier 0 governance is actually working?
A: Tier 0 governance is working only if the team can identify every direct and indirect route to control-plane access, review it on a repeatable cycle, and revoke anything not justified by current duties. If unmanaged trusts or application-local accounts remain outside review scope, the programme is only managing a subset of reality.
Q: What is the difference between tier 0 access and tier 1 access in governance terms?
A: Tier 0 protects the control plane that can alter identity and infrastructure at the highest level, while tier 1 covers business-critical systems such as ERP, finance and operational platforms. Tier 0 demands the tightest restriction and emergency-style handling; tier 1 needs broader role design, separation of duties and strong boundary enforcement.
Technical breakdown
Why tier 0 governance fails when trusts are invisible
Tier 0 is the control plane that can alter identity, security and infrastructure-wide policy. The technical problem is not tiering itself, but hidden privilege paths such as cross-forest trusts, federated access, nested permissions and legacy authentication links that bypass normal entitlement visibility. If a governance tool only reviews direct assignments, it misses the effective route by which a subject can reach control-plane power. That creates a false sense of least privilege because the recorded role is narrow while the reachable authority is broad.
Practical implication: catalogue indirect privilege paths before recertifying tier 0 access.
How federated and nested access escape IGA coverage
IGA platforms are strongest when entitlements are modelled cleanly at the directory layer, but federated and nested access often lives across identity providers, clouds and application-native accounts. In those cases, access is composed across systems rather than stored in one place. That makes it harder to answer the governance question of who can actually act, because the effective privilege is assembled at runtime from multiple trust relationships. The result is an access graph that exists operationally but not in the governance record.
Practical implication: include federated trusts and application-local accounts in every access review scope.
Why tier 1 needs RBAC, ABAC and separation of duties
Tier 1 governs business-critical systems such as ERP, finance and core operations. The article points to RBAC, ABAC and separation of duties because scale changes the problem: there are more users, more systems and more combinations of duties to enforce. RBAC gives repeatable assignment, ABAC narrows access with context, and separation of duties prevents one individual from controlling an entire critical workflow. Without those controls, the tier model becomes an organisational label rather than an operational boundary.
Practical implication: align tier 1 governance to task separation, not just named roles.
Threat narrative
Attacker objective: The objective is to obtain or preserve effective privileged access that exceeds the scope of what governance teams believe is assigned.
- Entry occurs through legitimate but over-broad tier 0 or tier 1 access that was inherited, federated or nested rather than explicitly approved.
- Credential or privilege use is amplified when hidden trusts and unmanaged application accounts allow actions beyond the reviewed entitlement set.
- Escalation happens when those indirect paths give the user effective control over higher-value infrastructure or business systems.
- Impact is broad administrative reach, lateral movement potential and governance failure because the organisation did not know the full access graph.
Breaches seen in the wild
- BeyondTrust breach 2024: A stolen BeyondTrust Remote Support API key let a China state-sponsored actor reset accounts and reach US Treasury workstations in 2024.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 150+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Enterprise access tiering fails when the access graph is incomplete: The governance model is only as strong as the identities and trust paths it can actually see. Clarity Security's point is not that tier 0 and tier 1 are flawed concepts, but that invisible federation, nested grants and unmanaged accounts turn those tiers into a partial map. The practitioner conclusion is simple: treat discoverability as part of governance, not as a separate housekeeping task.
Hidden trusts are the real tier 0 blind spot: Cross-forest trusts, cloud account linkages and legacy authentication paths can confer control-plane power without looking like a direct assignment. That is why a directory-centric review often underestimates who can reach the crown jewels. The practical implication is that access certification must include indirect authority, not just nominal membership.
Tier 1 needs governance by function, not by label: Business-critical systems are too numerous for a pure administrative model to hold together. RBAC, ABAC and separation of duties are the mechanisms that stop tier 1 from becoming a broad exception zone, but only if the organisation maps those controls to actual tasks and operating roles. The practitioner takeaway is to govern by workflow and duty split, not by title alone.
30% of access outside typical controls is a governance signal, not an anomaly: Clarity Security's figure shows that nested and federated access is large enough to reshape risk assumptions. That means access reviews which only measure direct entitlements are not measuring the true privilege estate. The implication is that identity governance must shift from static ownership lists to relationship-aware control coverage.
Access review cadence cannot compensate for a blind inventory: Monthly review cycles and periodic recertification still fail if the underlying access model excludes application-local accounts and trust-derived permissions. The real control gap is upstream, at the point where reachability is discovered and classified. Practitioners should therefore assume that governance quality is constrained first by inventory depth, then by review process maturity.
From our research library:
- 97% of NHIs carry excessive privileges, increasing unauthorised access and broadening the attack surface, according to the Ultimate Guide to NHIs.
- Read next: Ultimate Guide to NHIs — Key Challenges and Risks
What this signals
Relationship-aware inventory is the missing control: Access governance fails when programmes can list direct memberships but cannot reconstruct the trust relationships that create effective privilege. The practical shift is from entitlement review to access-graph review, because the risk sits in the path, not just the endpoint.
Tier 0 and tier 1 models remain useful, but only when the organisation can prove boundary enforcement across directories, clouds and application-native accounts. That means the next maturity step is not another policy statement; it is better discovery of the accounts and trusts that the IdP does not own.
For practitioners
- Catalogue indirect privilege paths Map cross-forest trusts, federated access, nested access and cloud account linkages before recertifying tier 0 and tier 1 access.
- Review application-local accounts separately Include accounts that are not managed from the IdP, because they can hold standing access that never appears in standard identity governance workflows.
- Enforce time-bound elevated access Use privileged identity management for temporary tier 0 tasks and revoke access immediately after the task or incident ends.
- Apply separation of duties to tier 1 systems Split configuration, approval and audit responsibilities so no single operator can fully control ERP, finance or other critical business platforms.
- Rebuild recertification scope around effective access Base access reviews on who can actually act through trusts and delegated paths, not only on direct entitlements in the primary directory.
Key takeaways
- Enterprise access tiering still helps, but governance breaks when trusts, nested permissions and unmanaged accounts sit outside the review boundary.
- Clarity Security says 30% of all access is nested or federated through trusts and outside typical controls, which shows how much privilege can be hidden from standard processes.
- The practical response is to govern effective access, not just directory records, and to include indirect paths in every tier 0 and tier 1 review.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 addresses the attack and risk surface, while NIST CSF 2.0, NIST SP 800-53 Rev 5 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-05 — Overprivileged NHI | Hidden trusts and unmanaged accounts create effective overprivilege across tier 0 and tier 1. |
| NHI-08 — Environment Isolation | Tier boundaries are meant to isolate control-plane access from lower tiers and business systems. | |
| NHI-10 — Human Use of NHI | The article warns against using broad shared or unmanaged access paths instead of governed admin identity. | |
| Recommendation — Audit indirect privilege paths and remove overprivileged NHI access that exceeds task scope. Separate tier 0 control-plane access from lower-tier and business-system administration. Prevent human operators from reusing unmanaged access paths across tiers. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | The article is fundamentally about who is entitled to access critical tiers and what is actually authorised. |
| Recommendation — Review permissions and authorisations across all trust paths, not just direct directory grants. | ||
| NIST SP 800-53 Rev 5 | AC-6 — Least Privilege | Tier 0 and tier 1 governance depends on limiting access to the minimum necessary authority. |
| Recommendation — Apply least privilege to tiered access and reduce any standing authority that exceeds role needs. | ||
| CIS Controls v8 | CIS-5 — Account Management | The article calls out unmanaged application accounts and incomplete account governance. |
| Recommendation — Manage all accounts, including application-local and federated identities, through a complete inventory. | ||
Key terms
- Enterprise Access Management: Enterprise access management is the set of policies and controls used to govern who can access which systems and under what conditions. In healthcare, it has to balance authentication assurance, clinical speed, auditability, and role changes across multiple connected applications and devices.
- Tier 0 Access: The highest-value administrative access in an environment, usually tied to identity infrastructure, cloud control planes, or other systems that can reshape the estate. Because this access can alter permissions and trust itself, it demands the strictest separation, review, and lifecycle control.
- Federated Access: A delegated access model that lets an AI client act through controlled identity flows instead of embedded long-lived secrets. For agentic systems, federation improves accountability because credentials can be scoped, tracked, and revoked more cleanly.
- Segregation of Duties: Segregation of Duties is a control principle that prevents one person or role from combining incompatible permissions that could create fraud, error, or undetected change. In ERP environments, it must account for roles, transactions, approvals, and compensating controls across business processes.
What's in the full article
Clarity Security's full analysis covers the operational detail this post intentionally leaves for the source:
- The full tier-by-tier access review guidance for Tier 0 administrators, PIM users and third-party vendors
- Examples of cross-forest, federated and nested access paths that teams should catalogue during governance work
- The article's recommended handling for application-local accounts that are not managed from the IdP
- The tier 1 governance patterns for RBAC, ABAC and separation of duties across business-critical systems
Deepen your knowledge
NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.
Published by the NHIMG editorial team on August 17, 2026.
Updated on October 7, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org