TL;DR: Nexis research argues that IAM systems need three linked changes: better interoperability, more useful metrics, and access reviews that work for real-world decision-making, including distributed estates and non-human identities. Access governance breaks down when reviews, data models, and measurement stay fragmented across systems.
At a glance
What this is: This is an IAM research overview from Nexis showing that interoperability, quantification, and access reviews all need redesign to match distributed identity environments.
Why it matters: It matters because IAM programmes that cannot connect systems, measure outcomes, and support accurate access decisions will struggle to govern human and non-human identities at scale.
👉 Read Nexis's research on IAM interoperability, metrics and access reviews
Context
IAM only works when identity data, policy decisions, and review outcomes can move across systems without losing meaning. This article argues that distributed identity estates expose three weak points at once: interoperability, quantification, and access reviews. The primary keyword, IAM, sits at the centre of the problem because the governance model has to work across humans, service accounts, machine identities, and the processes that certify them.
The article treats interoperability as a structural requirement rather than a technical convenience. It also frames metrics as a governance mechanism, not just reporting, and access reviews as a usability problem rather than a pure compliance task. That combination matters because programmes that optimise one layer in isolation often create blind spots in the others.
Key questions
Q: What breaks when IAM interoperability is treated as a basic data exchange problem?
A: Shared identity meaning breaks first. Systems may move records successfully while still interpreting entitlements, roles, and access events differently, which weakens governance across the stack. In practice, that creates mismatched policy enforcement, poor auditability, and fragmented remediation because teams cannot trust that the same identity concept means the same thing everywhere.
Q: How should organisations measure IAM effectiveness instead of just reporting activity?
A: They should tie each metric to a governance decision, a stakeholder, and an expected change in control quality. Useful IAM metrics show whether access control, compliance, and operational efficiency are improving together. If a number cannot guide action, compare trade-offs, or highlight drift, it is reporting noise rather than management signal.
Q: What do security teams get wrong about access reviews?
A: Teams often treat access reviews as proof of control, when they are really only a point-in-time check. If reviewers cannot see current activity and business context, they may approve access that is technically valid but operationally obsolete. The better test is whether the governance model can explain why access still exists.
Q: How can teams govern machine identities and AI agents in access reviews?
A: Teams should assign ownership, define review cadence, and include machine identities and AI agents in the same certification logic as human access, but with role-appropriate approvers. If a non-human identity can act on sensitive data, it needs a lifecycle owner and a removal path just like any other privileged account.
Technical breakdown
Why IAM interoperability now depends on shared data models
Modern IAM is no longer a single directory or a single policy engine. Once access decisions, identity attributes, and event data are distributed across tools, interoperability depends on whether systems interpret identity information in the same way, not just whether they can exchange it. The article’s SCIM extension work points to this shift: standards need to carry access-management context, RBAC semantics, and transaction-log evidence across systems. Without shared data models, orchestration becomes fragile and governance signals degrade as they move.
Practical implication: treat interoperability as a governance design problem, not just an integration task.
How IAM metrics become useful when tied to goals and audiences
Quantification only helps when a metric answers a decision question. The article’s 43 IAM metrics and 16 measurable access-control properties show that IAM measurement has to connect security, compliance, operational efficiency, and quality to specific stakeholders. Otherwise, dashboards become activity reports rather than steering tools. A metric that does not map to a goal or audience can still be numerically precise while remaining operationally irrelevant. That is the difference between measurement and management.
Practical implication: build IAM metrics around the decisions they must influence, not around what is easiest to count.
Why access reviews fail when they assume human-scale decision making
Access reviews are often treated as a straightforward certification workflow, but the article shows they are a usability problem with measurable failure modes. The reported gap between expected excessive access and actual revocation demonstrates that reviewers struggle to judge too many entitlements with too little structure. Digital nudges such as identity grids and choice defaults improve consistency, but they also increase cognitive load. That trade-off matters because the review process is only as reliable as the decision environment it creates.
Practical implication: redesign review workflows to reduce reviewer ambiguity before relying on stricter certification cadence.
Breaches seen in the wild
- Azure Key Vault Contributor escalation 2024: Datadog found Azure Key Vault Contributor could add itself to access policies and read every secret, key and certificate in a vault.
- Sisense breach 2024: A credential in Sisense's GitLab reportedly opened S3 buckets of customer tokens, passwords and certificates; CISA urged a full reset.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 150+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
IAM interoperability is now a governance dependency, not an integration preference. When identity data is distributed across services, access decisions become only as trustworthy as the weakest translation layer between systems. The article’s SCIM extension work reflects a wider pattern: if policy meaning cannot survive movement across tools, IAM no longer behaves like a governed fabric. Practitioners should treat semantic consistency across systems as a control objective, not a nice-to-have.
IAM metrics fail when they measure activity instead of control quality. The article’s 43-metric framework is most useful because it connects measurement to goals and audiences, not because it adds more indicators. That is the real shift: IAM governance needs metrics that distinguish administrative motion from actual risk reduction. A metric portfolio should tell teams whether access control, compliance, and operational performance are moving together or drifting apart.
Access reviews expose a decision-quality problem, not just a compliance workload problem. The article shows that reviewers can approve or revoke access more effectively when the interface reduces ambiguity, which means the process itself shapes governance outcomes. That makes access review design part of the control, not a front-end convenience layer. If the workflow overwhelms the reviewer, the certification result becomes a weak proxy for actual entitlement risk.
Identity fabrics will only work if interoperability, metrics, and review design mature together. The article points toward orchestrated IAM ecosystems where real-time sharing and policy coordination are central. That direction makes siloed governance unsustainable because a weak review process or a shallow metric model can undermine the whole fabric. The implication is clear: IAM programmes should be designed as connected governance systems, not as separate tool functions.
Quantified IAM governance creates a new operational language for human and non-human identity control. The article’s point about emerging AI agents, IoT devices, and machine identities is not that these actors are merely more numerous. It is that non-human identity changes the assumptions behind review cadence, attribution, and measurement. The practitioner conclusion is that governance models must become explicit about which identity type they are measuring and certifying.
From our research library:
- Over 70% of organisations lack automated access risk analysis, user access reviews and provisioning and deprovisioning, according to Pathlock's 2025 Digital Transformation and Access Risk Report.
- Read next: Access Reviews and Certification Guide
What this signals
Decision quality is becoming the limiting factor in IAM governance. Once identity estates span multiple systems, the main failure is rarely a lack of policy intent. The failure is that certification, metrics, and interoperability do not preserve enough context for reviewers and operators to make reliable decisions.
Access reviews should be redesigned as a measurable workflow. The article points to a future where review quality is judged by revocation accuracy, reviewer consistency, and the amount of context the interface can preserve. That shifts IAM governance from periodic compliance exercise to an operational control with observable performance.
Non-human identities force IAM programmes to separate human review logic from machine governance logic. AI agents, IoT devices, and machine identities do not fit neatly into human-centred review assumptions. IAM teams should expect more governance value from identity-type-specific workflows than from one universal certification model.
For practitioners
- Clarify IAM interoperability requirements Map which identity attributes, entitlement records, and event logs must remain semantically consistent across directories, apps, and governance tools. Use the same data model for access meaning wherever possible, especially where SCIM-style exchange and policy orchestration cross platform boundaries.
- Tie IAM metrics to governance decisions Define a small metric set that answers specific questions about security, compliance, and operational efficiency. Separate metrics that show activity from metrics that indicate control quality, and assign each one to a stakeholder who can act on it.
- Redesign access review workflows for decision quality Use identity grids, sensible defaults, and limits on how many revokes a reviewer must process in one session. Measure revocation outcomes and review consistency so the workflow reflects how people actually decide, not how the policy assumes they decide.
- Re-evaluate certification models for non-human identities Check whether current review cadences, evidence requirements, and approvers can govern machine identities, AI agents, and service accounts without forcing human assumptions onto non-human access patterns.
Key takeaways
- IAM research is pointing toward a more connected governance model where interoperability, measurement, and access reviews have to be designed together.
- The article shows that review quality and metric design are both decision problems, not just reporting or compliance problems.
- IAM programmes that continue to rely on human-scale assumptions will struggle to govern distributed estates and non-human identities effectively.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 addresses the attack and risk surface, while NIST CSF 2.0, CIS Controls v8 and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | The article centres on governing who can access what across distributed identity systems. |
| Recommendation — Apply PR.AA-05 to keep entitlements consistent across systems and review outcomes. | ||
| CIS Controls v8 | CIS-5 — Account Management | Access reviews and revocation outcomes map directly to account governance and lifecycle control. |
| Recommendation — Use CIS-5 to track account review quality and remove excessive access promptly. | ||
| NIST SP 800-53 Rev 5 | AC-2 — Account Management | The review and certification focus aligns with managing accounts and their lifecycle. |
| AC-6 — Least Privilege | The article’s review findings expose how excess access persists beyond least privilege expectations. | |
| Recommendation — Use AC-2 to govern account review, authorisation and removal across the identity estate. Apply AC-6 to verify that access reviews are actually reducing excess privilege. | ||
| OWASP Non-Human Identity Top 10 | NHI-01 — Improper Offboarding | The article’s non-human identity context makes lifecycle governance relevant as machine identities enter review scope. |
| NHI-05 — Overprivileged NHI | The article’s access review discussion maps to identifying and correcting excessive non-human access. | |
| Recommendation — Use NHI-01 to ensure non-human access is removed when identities or services are no longer needed. Use NHI-05 to detect overprivileged service and machine identities during certification cycles. | ||
Key terms
- Identity Interoperability: Identity interoperability is the ability for different systems and vendors to represent, validate, and govern the same identity subject consistently. It matters because fragmented semantics create audit gaps, inconsistent lifecycle handling, and control drift across platforms.
- Access Review: A formal process for confirming whether access is still needed and justified. In IAM programs, the review becomes an evidence-bearing control when decisions are recorded, scoped correctly, and traceable to the right reviewer, application owner, or auditor.
- IAM Metric: A measured indicator used to steer identity and access management toward a governance goal. A useful IAM metric is linked to a stakeholder, a decision, and a desired control outcome, so it can show whether security, compliance, or operational performance is improving.
- Identity Fabric: An identity fabric is a connected control model that shares context across governance, privileged access, and access management. It is not a product category. The aim is to make identity decisions coherent across the full lifecycle so ownership, privilege, and enforcement reinforce each other.
What's in the full article
Nexis's full research covers the operational detail this post intentionally leaves for the source:
- The SCIM extension work and API design principles behind interoperability
- The full list of 43 IAM metrics and how they map to goals and audiences
- The access review usability findings, including identity grids and choice defaults
- The practical discussion of identity fabric architectures and real-world validation
Deepen your knowledge
NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.
Published by the NHIMG editorial team on August 14, 2026.
Updated on October 7, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org