Extending identity governance to physical access needs one framework

At a glance

What this is: This is a blog post about extending identity governance from application access to physical access, with the core finding that badge systems are often left outside the same review and lifecycle controls.

Why it matters: It matters because IAM and IGA programmes that exclude physical access leave a major governance gap between logical entitlements and real-world entry points.

By the numbers:

• More than 3,100 enterprises run identity governance on SailPoint.

Context

Identity governance breaks down when organisations treat digital entitlements and physical entry as separate control planes. In practice, the same person can be governed tightly in SaaS and ERP while badge access sits in a disconnected system with no equivalent review or lifecycle discipline.

The core problem is not access volume but governance consistency. If an organisation can certify who may access SAP in minutes, but cannot answer the same question for a door badge, then the identity programme is only partially covering the enterprise.

This gap is common because physical access systems were often built for facilities operations, not identity governance. Bringing them under one model makes the badge system part of the same NHI lifecycle management problem set as other governed access paths.

Key questions

Q: How should identity governance teams include physical access in certification programmes?

A: Treat physical access as another governed entitlement, not a separate facilities process. Put badge records into the same certification cadence, approval trail, and removal workflow used for digital access so reviewers can see who still has access, why they have it, and whether it should remain in place.

Q: Why do simple automation tools create governance risk in IAM and IGA programmes?

A: Simple automation tools reduce the barrier to entry, which often spreads workflow creation beyond central IT. That can produce shadow automations, undocumented business logic, and inconsistent approval handling across onboarding and offboarding. In IAM and IGA programmes, the risk is not the tool itself, but the control gap created when many people can automate identity decisions without shared standards.

Q: What is the biggest mistake teams make when governing physical access?

A: The common mistake is treating physical access as a facilities problem instead of an identity problem. Once badge access is tied to employment status, role, or approval, it needs the same lifecycle controls as any other entitlement, including provisioning, review, and offboarding.

Q: How do hospitals know whether physical access governance is actually working?

A: Look for synchronisation across badge, visitor, and workforce systems. If access is removed immediately across all three when a role changes or a contract ends, governance is working. If staff can still enter restricted spaces after offboarding, the control plane is fragmented and the programme is failing.

Technical breakdown

Why physical access becomes an identity governance problem

Physical access turns into an identity governance issue when the badge, the person, and the entitlement are managed as linked records. The governance challenge is not the lock or reader itself, but whether the organisation can provision, certify, and revoke access with the same controls it uses for logical systems. Once physical access is tied to employment, role, or risk context, it belongs in the lifecycle and review process rather than in a disconnected facilities workflow. See the IAM and IGA Basics.

Practical implication: Treat badge access as a governed entitlement that must be visible to IGA, not as an isolated facilities record.

What breaks when badge systems sit outside certification

When badge systems are not covered by certification, access can persist long after the business need has changed. That creates review drift: the organisation may know who approved a system entitlement, but not who still holds physical access or why. The result is a split control environment where audit evidence is incomplete and offboarding is only half done. The problem is structural, because the governing system cannot close the loop if the asset is outside its workflow. See the Access Reviews and Certification Guide.

Practical implication: Bring physical access into the same certification and offboarding logic used for logical access.

How one framework can govern both logical and physical access

A unified framework works when the identity platform becomes the system of record for both digital and physical entitlements. That means common lifecycle events, common policy enforcement, and common reporting across access types. The key architectural shift is not technical convergence for its own sake, but making every access point answerable to the same identity governance model. Without that, compliance reporting stays partial and access reviews remain incomplete. Read the Ultimate Guide to NHIs: Regulatory and Audit Perspectives.

Practical implication: Map physical access events into the same governance controls and reporting chain as application access.

Breaches seen in the wild

• HPE Aruba Instant On hard-coded credentials: Hard-coded admin credentials in HPE Aruba Instant On access point firmware let anyone bypass login (CVE-2025-37103); no exploitation reported.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Physical access is the forgotten edge of identity governance: Most programmes are built to certify application access, but the same governance logic often ends at the badge system. That leaves a control boundary where the organisation can defend logical privileges yet still fail to govern the door, which is part of the same access estate. The practical conclusion is that identity governance is incomplete when facilities access sits outside it.

Lifecycle control loses value when one entitlement class is excluded: Provisioning, recertification, and offboarding only work when they apply to the full set of access paths a person can use. If physical access is outside the workflow, then least privilege is only partially enforced and offboarding is not truly complete. That is a governance design flaw, not a tooling inconvenience.

One access model creates better auditability than two disconnected ones: Organisations that can answer who approved access, who owns it, and when it was last reviewed across both digital and physical environments have a materially stronger compliance posture. The value is not merely operational convenience; it is evidentiary consistency. Regulatory and audit perspectives matter because auditors do not distinguish between convenient silos and incomplete control coverage.

Convergence should be measured by governed coverage, not integration count: A badge integration is only meaningful if it changes the review, lifecycle, and reporting model, not just the interface layer. The real test is whether the organisation can treat physical access as a governed entitlement with the same discipline used for digital access. Practitioners should judge convergence by coverage and evidence, not by connector availability.

From our research library:

• Nearly 60% of IT leaders cite restrictive cost and complexity as a weakness of legacy identity governance, according to the 2025 State of Identity Governance Report.
• Read next: Access Reviews and Certification Guide

What this signals

Physical access should be treated as part of the identity estate, not a side system owned only by facilities. When the same governance model covers badges, applications, and lifecycle events, the organisation reduces the chance that access survives outside review boundaries and creates a cleaner evidence trail for audits.

Governed access coverage: The real maturity test is whether every access point can be certified, revoked, and reported through the same control chain. That shift matters because split governance models usually fail first at the edges, where physical and logical access stop meeting.

For IAM and IGA teams, the next programme question is not whether badge integration exists, but whether it changes the control model. If it does not affect certification, offboarding, and reporting, then the organisation still has two access programmes instead of one.

For practitioners

• Extend access certification to physical entitlements Include badge holders in the same review cadence, evidence model, and approval workflow used for application access.
• Link physical access to identity lifecycle events Trigger badge provisioning and revocation from joiner, mover, and leaver changes so physical access does not drift from HR status.
• Unify audit evidence across access types Make the identity platform the source of truth for who approved access, when it was last reviewed, and when it was removed.
• Compare facilities records against governed identities Reconcile badge system records with identity governance data to surface stale physical access that no longer matches role or employment status.

Key takeaways

• Physical access is part of the identity governance problem, not an adjacent facilities-only concern.
• The governance gap appears when badge access cannot be certified or revoked with the same discipline as application access.
• A unified identity model matters because audit evidence, lifecycle control, and review coverage have to span both logical and physical access.

Related NHI Mgmt Group resources: NHI Lifecycle Management Guide · Access Reviews and Certification Guide · Ultimate Guide to NHIs: Regulatory and Audit Perspectives

Key terms

• Physical Access Governance: The discipline of controlling who may enter a building, zone or restricted area using authoritative identity data, role context and review processes. It treats badges, doors and turnstiles as governed access assets rather than isolated facilities tools, with lifecycle controls that prevent stale or copied access from persisting.
• Access Certification: Access certification is the periodic review of whether an identity still needs its current entitlements. For NHIs, certification is only reliable when reviewers know the identity's owner, purpose, and expiry, otherwise stale machine access can persist long after the original use case has ended.
• Identity Lifecycle Event: A business event that changes a person’s access, obligations, or record status, such as hiring, role change, or offboarding. In HR programmes, these events often drive entitlement changes and evidence requirements, so they need to be governed as part of the identity lifecycle rather than handled as isolated paperwork.
• Governed Entitlement: An access right that is visible to policy, review, and removal workflows rather than left in a separate operational silo. The term applies equally to application permissions and physical badges when an organisation wants one control model across the enterprise.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.