TL;DR: Enterprises with formal IGA processes still struggle with joiner delays, mover risk, leaver sprawl, and AI-related service identities that lack clear ownership, according to SafePaaS. The governance problem is no longer workflow volume alone, but whether policy, accountability, and evidence remain structurally separated.
At a glance
What this is: This is a governance analysis of federated identity access control, showing that many enterprises still have fragmented joiner, mover, leaver, and NHI oversight despite formal IGA and IAM processes.
Why it matters: It matters because IAM, IGA, PAM, and NHI programmes fail when ownership and evidence are separated from enforcement, especially as service identities and AI-related accounts multiply across SaaS and ERP.
Context
Federated identity access governance is a way to split access decision-making from access enforcement without losing accountability. The problem it addresses is not a lack of tools, but a governance model that cannot keep pace with enterprise-scale joiners, movers, leavers, and non-human identities.
In this model, the central control layer codifies policy and risk while business owners make local decisions inside clear guardrails. That matters for NHI governance because service accounts, APIs, bots, and AI-related identities now need the same lifecycle ownership and audit evidence as human access.
The article’s core claim is that many organisations already have formal IGA and IAM processes, yet still rely on tickets, spreadsheets, and delayed approvals that create operational risk. That starting point is typical, not unusual, for enterprises that have grown their identity estate faster than their governance operating model.
Key questions
Q: How should security teams govern joiner, mover, and leaver access when approvals are federated?
A: Security teams should separate policy definition from local approval authority, then tie both to authoritative identity and HR data. That lets business owners approve within guardrails while the central team preserves consistent enforcement and evidence. The key test is whether lifecycle changes are evaluated continuously, not only during periodic cleanup or review cycles.
Q: Why do federated identity governance models need explicit ownership for service accounts and bots?
A: Because non-human identities create access without a natural employee owner, which makes approvals, review, and offboarding ambiguous. Without explicit ownership, the organisation cannot explain who accepted the risk or who is responsible for revocation. That weakens both auditability and remediation when privileges outlive the project or process they support.
Q: What breaks when access governance is still built around tickets and long-lived credentials?
A: Ticket-based and credential-heavy models break when work moves faster than human approval cycles. Engineers wait, security loses visibility, and permissions accumulate instead of expiring. In cloud and AI environments, that creates more standing access, weaker accountability, and a larger blast radius. Governance has to shift from slow approval to time-bound control and automatic revocation.
Q: How do organisations know whether federated governance is actually working?
A: Organisations know federated governance is working when access decisions are made by accountable owners, policy exceptions are tracked centrally, and evidence is generated automatically from the control layer. If auditors still need screenshots, spreadsheets, or manual explanations, the governance model is not yet providing reliable control.
Technical breakdown
How federated identity governance separates policy from approval
Federated identity governance uses an independent control layer to evaluate access against central policy while routing decisions to the right business owner. In practical terms, this means the governance plane is not the same thing as the application admin plane, and approval is not the same thing as enforcement. That separation is what allows organisations to keep audit evidence consistent across ERP, SaaS, cloud, and AI systems. Without it, governance becomes a ticketing exercise rather than a control system.
Practical implication: put policy evaluation and evidence generation in a control layer that is independent of the target application.
Why joiner, mover, and leaver workflows break at scale
Joiner, mover, and leaver processes fail when they depend on manual routing and human memory rather than authoritative identity data. Joiners wait in queues, movers accumulate incompatible access as roles change, and leavers retain accounts or entitlements after departure. The same lifecycle weakness now extends to NHI estates, where service accounts and bots often lack a clear owner or offboarding trigger. Federated governance tries to make those lifecycle events continuously visible instead of only reviewable in periodic cleanup cycles.
Practical implication: tie identity lifecycle decisions to authoritative sources and evaluate changes continuously, not only during review campaigns.
What happens when AI-related service identities have no clear owner
AI-related service identities, APIs, and bots create governance gaps when ownership, privilege scope, and auditability are undefined. These identities are often deployed across ERP and SaaS with access that no one can fully explain, which breaks the assumption that every privilege can be traced to a responsible approver. For NHI programmes, the issue is not just excess access. It is missing accountability for identities that do real work but sit outside traditional user-centric governance models.
Practical implication: assign explicit ownership and lifecycle accountability to every non-human identity before it enters production.
Threat narrative
Attacker objective: The objective is not a single breach, but sustained over-privilege and unowned access that weakens control assurance and expands operational risk.
- Entry occurs through routine provisioning and role changes that are handled by queue-based workflows rather than policy-enforced access control.
- Credential or entitlement accumulation happens when movers gain new access without timely removal of prior privileges, and leavers keep accounts beyond departure.
- Escalation occurs when AI-related service identities, APIs, and bots inherit privileges that no one can clearly justify or audit.
- Impact shows up as delayed go-lives, emergency production fixes, and repeat audit findings tied to unresolved access risk.
Breaches seen in the wild
- Cisco Yanluowang breach 2022: A password synced to a personal Google account plus vishing and MFA fatigue opened Cisco's VPN; the attacker then abused machine accounts.
- Cisco Active Directory credentials leak 2025: Kraken leaked Cisco Active Directory hashes, including service and krbtgt accounts; Cisco says they came from its 2022 breach, not a new one.
Read our 52 NHI Breaches Analysis report for a comprehensive view of breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Federated governance works only when policy, accountability, enforcement, and evidence remain structurally separate. That separation is the real control model, not the workflow wrapper around it. When central IAM teams become routing desks for every decision, governance degrades into fulfilment and the business loses the ability to prove who owned the risk. The practitioner conclusion is straightforward: if those four functions blur together, the programme is not federated governance at all.
Identity lifecycle governance now has to cover service accounts, APIs, bots, and AI-related identities as first-class subjects. The article correctly shows that non-human identities are no longer edge cases hidden inside technical teams. They are production identities with business impact, and they need ownership, reviewability, and offboarding just as much as human accounts do. The practitioner conclusion is that user-centric governance models are incomplete unless they explicitly absorb NHI lifecycle control.
Joiner, mover, and leaver governance fails when it is designed for periodic review rather than continuous change. The operating model described here assumes that access state is stable long enough to queue, approve, and evidence it. That assumption breaks when role changes, application sprawl, and NHI growth are happening at the same time. The practitioner conclusion is that control design must shift from event-driven cleanup to always-on policy enforcement.
Clear ownership is becoming the decisive control for NHI risk, not just privilege scope. Excessive access is bad, but unowned access is worse because no one can explain the decision trail, assign remediation, or satisfy audit. This is why federated models matter: they force accountability to be explicit rather than implied. The practitioner conclusion is that every machine identity should have a named business owner and a testable lifecycle path.
Federated identity access governance is really a control architecture for distributed decision rights. That makes it a governance pattern rather than a point product feature. The article signals where the market is heading: enterprises need evidence-rich control layers that can span ERP, SaaS, cloud, and AI without collapsing back into spreadsheet orchestration. The practitioner conclusion is to judge identity governance by decision quality and evidence consistency, not by workflow volume.
From our research library:
- Nearly 60% of IT leaders cite restrictive cost and complexity as a weakness of legacy identity governance, according to the 2025 State of Identity Governance Report.
What this signals
Federated control is the new operating question for identity teams. As service accounts and AI-related identities grow, the old assumption that governance can be handled through periodic review is no longer durable. The programme issue is not whether there are approvals, but whether the identity lifecycle can be governed continuously across human and non-human actors.
Access ownership is becoming the primary control signal for NHI maturity. When no one can name the business owner for a service account or bot, the organisation has already lost more than visibility. It has lost the ability to certify, remediate, and explain the risk in a way auditors and business owners can trust.
For practitioners
- Map every identity to a named decision owner Document who owns access decisions for each business process, application, and non-human identity before governance rules are enforced.
- Separate approval from enforcement Keep request, approval, and provisioning responsibilities structurally distinct so no single team can both approve and self-enforce access.
- Reconcile movers against prior entitlements Review role changes for residual access combinations that create segregation-of-duties conflicts or excessive privilege across systems.
- Assign lifecycle ownership to non-human identities Treat service accounts, APIs, and bots as governed identities with an explicit owner, review cadence, and revocation path.
- Centralise audit evidence for access decisions Capture approvals, policy context, and remediation actions in one control layer so audit testing does not depend on screenshots or spreadsheets.
Key takeaways
- Federated governance is meant to close the gap between central policy and local execution, but it only works when accountability is explicit and evidence is independently generated.
- The article describes a familiar pattern: slow joiners, risky movers, lingering leavers, and machine identities that outlive clear ownership.
- For practitioners, the main implication is to treat non-human identities as governed assets with lifecycle ownership rather than as technical leftovers hidden inside application administration.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 and MITRE ATT&CK address the attack and risk surface, while NIST CSF 2.0 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-01 — Improper Offboarding | The article repeatedly highlights lingering leaver accounts and unowned machine identities. |
| NHI-05 — Overprivileged NHI | Excessive privilege on AI-related service identities and machine accounts is a core problem here. | |
| NHI-10 — Human Use of NHI | The article warns that governance weakens when humans rely on machine identities without clear ownership. | |
| Recommendation — Track offboarding for service accounts and bots with the same discipline used for human leavers. Review NHI privileges against business need and remove access that no owner can justify. Prevent informal human use of NHI credentials by binding each identity to a documented owner and purpose. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | The post is fundamentally about controlling and evidencing entitlements across identity lifecycles. |
| Recommendation — Apply PR.AA-05 to keep access decisions policy-driven, traceable, and continuously reviewed. | ||
| CIS Controls v8 | CIS-5 — Account Management | Lifecycle governance for joiners, movers, leavers, and service accounts maps directly to account management. |
| Recommendation — Use account management controls to reconcile active identities, remove stale accounts, and document ownership. | ||
| MITRE ATT&CK | TA0006;TA0008 — Credential Access; Lateral Movement | The risk pattern includes over-privileged accounts that can be abused once access is not well governed. |
| Recommendation — Map unowned or excessive access to credential-access and lateral-movement risk in your detection and response. | ||
Key terms
- Federated identity governance: Federated identity governance distributes control across platforms and business units while keeping policy, evidence, and accountability aligned. It is used when identities and permissions are managed in multiple systems, but the organisation still needs one risk view and one governance standard.
- Non-Human Identity (NHI): A digital identity assigned to a non-human entity such as a software application, service account, API key, bot, machine, or AI agent that enables it to authenticate and interact with systems without direct human involvement. NHIs now outnumber human identities in most enterprises by 25 to 50 times.
- Access Decision Context: The set of facts available when an approver or policy engine evaluates access. For identity governance, this includes current posture, active findings, affected resources, and identity type, so the decision reflects present risk rather than stale tickets or static role membership.
- Independent Control Layer: An independent control layer is a governance platform that sits between business decision-makers and target systems to evaluate access, route approvals, and record evidence. Its value is separation: it can prove control operation even when the underlying application is not the source of truth.
Deepen your knowledge
NHI governance, identity lifecycle management, and secrets management are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.
Published by the NHIMG editorial team on June 2, 2026.
Updated on October 6, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org