TL;DR: IAM data management is breaking under wider application estates, manual fulfilment, and rigid IGA deployments, according to READI, with a cited survey finding 51% of respondents blamed process changes for distressed projects. The governing issue is no longer tooling alone but whether identity programmes can adapt workflows, coverage, and data flows without redesigning the business around the platform.
At a glance
What this is: NHI Mgmt Group's analysis, drawing on READI's blog post: IAM data management is struggling as application sprawl, manual fulfilment, and narrow IGA scope make identity fabrics harder to adapt.
Why it matters: IAM teams need a governance model that can cover broad application estates, reduce manual error, and support lifecycle control across both workforce and non-human access flows.
By the numbers:
- 51% of respondents said the main reason for their IGA project being in distress was having to change existing business processes to fit the technology solution.
Context
IAM data management fails when the programme assumes it can standardise identity workflows before it can connect them. In practice, many organisations inherit fragmented application coverage, manual fulfilment steps, and brittle integrations that make identity data hard to trust and harder to operationalise.
The problem is wider than classic employee onboarding. Modern identity estates span SaaS, private cloud, on-prem systems, APIs, microservices, and the workflows that surround them, so identity governance now depends on flexible data flow and process orchestration rather than a narrow IGA deployment model. IAM and IGA basics
Where identity data is isolated, automation becomes a patch rather than a control plane. The result is slow request handling, inconsistent reviews, and governance that works for a few systems but not for the full estate.
Key questions
Q: How should teams reduce manual fulfilment in identity programmes?
A: Start by identifying the access requests that recur often enough to standardise. Automate those paths first, then keep exceptions visible so the programme does not hide unresolved governance issues behind workflow shortcuts.
Q: Why do narrow IGA deployments create governance gaps?
A: Narrow IGA deployments create governance gaps when they only cover a subset of systems, identities or entitlement types, leaving unmanaged accounts, manual spreadsheets and out-of-band approvals outside review. The gaps usually appear in joiner-mover-leaver processes, access recertification and privileged access, where an offline review can miss orphaned accounts, hidden service accounts or stale entitlements.
Q: What is the best way to automate identity data flows?
A: The best way to automate identity data flows is to connect source systems to a governance or provisioning layer using authoritative sources for people, roles and entitlement data. That typically means synchronising HR, directory and application records through APIs, event feeds or SCIM-style provisioning, with validation, exception handling and reconciliation to catch conflicting identity records.
Q: How do teams know whether identity governance is actually complete across the estate?
A: They do not rely on workflow completion alone. They check whether every in-scope application can be provisioned, reviewed, recertified, and revoked through a governed process with evidence. If even one material application sits outside that cycle, governance completeness has not been achieved.
Technical breakdown
Why narrow IGA scope creates governance debt
Traditional IGA programmes often start with a limited application set because connector costs, integration complexity, and process redesign effort constrain rollout. That creates governance debt: the organisation pays for a control plane that only partially maps the real estate, while the rest of the environment falls back to ticketing and manual fulfilment. The technical failure is not only coverage. It is that identity data, entitlement assignment, and review workflows become split across systems that cannot share a consistent lifecycle model. See the Identity Visibility and Intelligence Platforms (IVIP) Guide.
Practical implication: Treat incomplete application coverage as a control gap, not a rollout milestone, and measure how much of access governance still depends on offline fulfilment.
How agile automation changes identity data flows
Agile automation in IAM is not a process shortcut. It is a design approach that keeps existing authoritative sources, downstream systems, and human workflows in place while connecting them through adaptable orchestration. That matters because identity data is only useful when it can move cleanly between source, decision, and enforcement points. When the programme can adapt flows without redesigning the business around the tool, it can support broader application coverage and more reliable access operations. See the Identity Data Quality and Identity Fabric Guide.
Practical implication: Build automation around existing data sources and operational flows so governance improves without forcing a full process rewrite.
Why zero standing privilege depends on connected identity fabrics
Zero standing privilege and just-in-time access only work when identity data, request handling, and entitlement enforcement are tightly connected. If those components are fragmented, the organisation cannot reliably remove persistent access or issue ephemeral access at the point of need. The architectural issue is not just privilege reduction. It is that the control depends on global visibility across systems, otherwise standing access simply reappears in manual exceptions and disconnected fulfilment paths.
Practical implication: Tie privileged access workflows to identity data flows that can enforce ephemeral access consistently across the estate.
Breaches seen in the wild
- Azure Key Vault Contributor escalation 2024: Datadog found Azure Key Vault Contributor could add itself to access policies and read every secret, key and certificate in a vault.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Identity data fabric is now a control problem, not a tooling preference. Once governance spans SaaS, on-prem systems, APIs, and microservices, narrow application coverage stops being an implementation detail and starts shaping risk. A fragmented fabric forces exceptions into ticketing, custom glue code, and offline fulfilment, which weakens both auditability and control consistency. The practical conclusion is that identity programmes should be judged on estate-wide operability, not on whether the core platform is technically installed.
Rigid IGA design creates process debt that outlives the deployment. The article’s core signal is that waterfall-style identity projects lock teams into assumptions that the business, applications, and onboarding paths will remain stable. That assumption fails as soon as the application mix changes faster than the control model can adapt. Practitioners should treat process rigidity as a structural governance defect, not as a project management inconvenience.
Coverage gaps become governance gaps: when only a subset of systems is connected, identity review and fulfilment lose evidential value outside that boundary. That makes manual exception handling part of the security model, even when no one intended it to be. Teams need to recognise that incomplete connector coverage changes the meaning of compliance itself, because the programme cannot attest confidently to what it cannot reach.
Agile automation is best understood as identity operations resilience. The value is not just fewer manual steps. It is the ability to keep identity data current as the estate changes, so access decisions remain aligned to business reality. That makes automation a prerequisite for scaling governance across mixed environments, not a nice-to-have efficiency layer. Programme owners should align architecture, operations, and audit expectations around change tolerance rather than static system design.
Right-size access depends on lifecycle connectivity, not isolated remediation. Concepts such as zero standing privilege and just-in-time access only hold when the identity fabric can enforce them across systems rather than inside a single tool boundary. The moment entitlement enforcement breaks into manual workarounds, the programme reintroduces persistent access by default. Identity leaders should treat lifecycle connectivity as the condition for least privilege, not as a downstream optimisation.
What this signals
Coverage quality is becoming the real identity programme benchmark. As application estates expand, teams will be judged less on whether they own an IGA platform and more on whether they can govern access across the systems that still sit outside it. That shifts programme design toward connectivity, lifecycle consistency, and operational evidence rather than feature checklists.
The next governance constraint is not simply scale, but adaptability. Identity teams that cannot absorb changes in applications, workflows, and ownership will keep reintroducing manual exceptions, which means their control model will always trail the business it is meant to support.
Identity operations will increasingly converge with workflow engineering. The practical challenge is to keep identity data current while avoiding process redesign fatigue. Programmes that can translate business change into governed automation will have a better chance of sustaining both compliance and operational throughput.
For practitioners
- Map the disconnected estate first Inventory the applications, services, and manual fulfilment paths that sit outside the core governance tool so you know where policy is not enforced end to end.
- Reduce process redesign pressure Preserve existing business workflows where they already work and automate around them instead of forcing teams into a new operating model for every application.
- Measure coverage as a control metric Track how many entitlements, request paths, and review steps are still handled through offline tickets or custom code rather than governed flows.
- Prioritise systems with the highest governance drag Start with the applications that create the most manual effort, review delay, or business disruption so automation effort lands where it changes outcomes fastest.
- Use lifecycle controls to support privilege minimisation Align request, fulfilment, and review processes so standing access is reduced only where the identity fabric can actually enforce the change across the estate.
Key takeaways
- IAM data management fails when identity workflows, application coverage, and fulfilment paths stay fragmented across tools and manual processes.
- The pressure on governance now comes from estate sprawl as much as from control design, because modern identity environments include SaaS, APIs, microservices, and legacy systems.
- Automation only improves identity governance when it is built around existing data flows and lifecycle controls rather than forcing the business to remodel itself around the platform.
Related NHI Mgmt Group resources: IAM and IGA Basics · Identity Visibility and Intelligence Platforms (IVIP) Guide · Identity Data Quality and Identity Fabric Guide
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 addresses the attack and risk surface, while NIST CSF 2.0, CIS Controls v8 and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-05 — Overprivileged NHI | Overprivileged access persists when identity governance covers only part of the estate. |
| NHI-08 — Environment Isolation | Disconnected IAM fabrics create isolated control zones with inconsistent lifecycle enforcement. | |
| Recommendation — Reduce standing access by extending governance coverage to every system that can issue or hold privilege. Separate and govern identity flows so manual exceptions do not bypass enterprise access controls. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | The article is fundamentally about managing permissions and entitlements across a broader estate. |
| Recommendation — Apply entitlement governance consistently across connected and disconnected systems. | ||
| CIS Controls v8 | CIS-5 — Account Management | Account lifecycle and fulfilment are central to the automation and governance problem described. |
| Recommendation — Standardise account and entitlement lifecycle handling across all business applications. | ||
| NIST SP 800-53 Rev 5 | IA-5 — Authenticator Management | Access workflows depend on managing credentials and fulfilment at lifecycle points. |
| Recommendation — Use authenticator lifecycle controls to reduce manual handling and stale access paths. | ||
Key terms
- Identity data fabric: An identity data fabric is a consolidated layer that aggregates identity and access information from multiple sources into a more coherent view. It does not erase the source systems, but it makes entitlements, approvals, and account state easier to query, reconcile, and govern across the programme.
- Identity Governance and Administration (IGA): A framework of policies, processes, and technology to manage and govern digital identities and their access rights. Increasingly extended to cover non-human identities alongside human users.
- Just-in-Time (JIT) Access: Just-in-Time (JIT) Access grants permissions only when needed and removes them after use. In IAM and PAM, it reduces standing privilege by issuing time-bound access based on approval, context, or policy, limiting exposure for humans, service accounts, and non-human identities while improving auditability and control.
- Zero Standing Privilege: A control model in which an identity does not keep persistent access unless it is actively needed. For NHIs, this means credentials and permissions are issued for a narrow task and then removed. It reduces the time window and reuse value of stolen access.
Deepen your knowledge
NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.
Published by the NHIMG editorial team on November 5, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org