TL;DR: Fast, secure identity access across shared devices, frontline workflows, and privileged users can reduce friction in regulated environments, according to Imprivata. The governance question is not speed versus security, but whether access controls are embedded well enough to work across every user type, device class, and critical workflow.
At a glance
What this is: This is an Imprivata analysis of identity access for regulated workflows, arguing that secure access has to work across shared devices, privileged users, and frontline processes.
Why it matters: It matters because IAM, PAM, and NHI programmes in regulated environments fail when access is designed for one user class or device model and cannot scale across real workflows.
Context
Regulated workflows break when access controls sit outside the work itself. In healthcare, manufacturing, and other high-stakes environments, users need fast authentication on shared devices, but they also need controls that preserve security, privacy, and auditability while keeping the workflow moving.
The identity problem here is governance, not simply login friction. If authentication is not embedded across workstations, mobile devices, operational technology, and connected devices, organisations end up with inconsistent access paths for employees, third parties, and privileged internal users.
Key questions
Q: How should security teams govern access on shared devices in manufacturing environments?
A: Security teams should treat shared-device access as a workflow problem, not just an authentication problem. The controls need fast user switching, clean session reset, and auditable handoffs between workers. If a control slows production enough to trigger workarounds, it will be bypassed, so usability and accountability must be designed together.
Q: Why does privileged access need to be managed with workflow access?
A: Because privileged users often operate through the same regulated systems, devices, and approval paths as everyone else. When PAM sits apart from workflow access, the organisation loses visibility into when elevation occurs and why. The control objective is not to separate the two, but to make elevated access auditable inside the same operating model.
Q: What breaks when email authentication is not enforced for sensitive workflows?
A: When email authentication is weak, attackers can spoof trusted senders, hijack password resets, and manipulate approvals or payments. The result is not only mailbox compromise but business-process compromise, because recipients act on messages that appear legitimate. Organisations should treat authenticated email as a control for both fraud prevention and operational integrity.
A: They should apply one governance model with role-specific controls, rather than separate, inconsistent processes for each user type. The point is to keep policy, auditability, and approval logic aligned while still recognising different risk levels. That approach reduces fragmentation without pretending every identity behaves the same way.
Technical breakdown
Shared-device identity must follow the workflow, not the user session
Shared-device environments create a different identity pattern from personal endpoints because the device is reused by multiple users, often in time-sensitive workflows. Authentication has to be durable enough to establish who is acting, but lightweight enough not to interrupt clinical, operational, or production tasks. That means the control plane must extend across device classes and not assume a one-user, one-device, one-session model. When the access model is bolted on after the workflow is designed, teams get workarounds, shadow processes, and inconsistent enforcement.
Practical implication: design identity controls around the workflow path and device context, not around the assumption of a dedicated endpoint.
Privileged access governance is part of regulated workflow security
Privileged users are not a separate problem from regulated workflow access. They are part of the same governance surface because vendors, employees, and internal admins may all need elevated access to critical assets. Privileged access security therefore has to be lifecycle-aware, auditable, and consistent with the broader access model. If privileged controls are handled as an isolated toolset, organisations lose visibility into how elevated access intersects with daily operational work and regulated data handling.
Practical implication: align PAM governance with workflow access governance so elevated access is visible in the same control model.
Access embedding changes the control point from perimeter to execution
Embedding authentication directly into workflows shifts the security control from an external gate to the point of use. That matters because regulated environments depend on knowing not just who can enter the system, but who is authorised at the moment of action. This is especially important when access must span employees, third parties, and privileged internal users across multiple device types. The result is a more consistent identity layer, but only if governance covers issuance, authentication, and access scope together.
Practical implication: move access governance closer to execution so authorisation is checked where the work actually happens.
NHI Mgmt Group analysis
Regulated workflow access is a governance problem first, a usability problem second. Imprivata's framing reflects a real operational truth: in healthcare and other regulated industries, if access is too slow or too fragmented, users route around it. That creates unmanaged variation across shared devices, critical applications, and privileged tasks. The practitioner lesson is that governance has to make the secure path the easiest path, not the exception.
Shared-device environments expose the weakness of per-user IAM assumptions. Traditional access design often assumes a stable endpoint and a relatively fixed user session, but frontline work rarely behaves that way. Shared devices, mobile endpoints, and operational technology create overlapping identity contexts that need stronger session and device-aware controls. The implication is that IAM programmes should stop treating shared-device access as a niche problem and treat it as a core enterprise pattern.
Privileged access and regulated workflow access are converging control domains. The article links employees, third parties, and privileged internal users in the same access story, which is how practitioners should think about it. Once privileged access moves through the same workflows and devices as everyday access, the boundary between PAM and access management becomes operational rather than organisational. The takeaway for teams is to govern elevation, authentication, and workflow access as one control surface.
Identity security for critical industries needs embedded control, not bolt-on enforcement. The strongest concept here is embedded authentication, meaning access verification is part of the workflow rather than an external interruption. That approach only works when the organisation can govern every user category consistently across devices and assets. For practitioners, the question is whether current controls are integrated enough to survive real-world operational pressure.
What this signals
Embedded authentication changes the control boundary. When access is built into the workflow, the decisive question becomes whether the organisation can govern action at the point of use rather than relying on a separate login event. That is the right model for regulated environments where shared devices and time-sensitive work dominate.
Shared-device governance is now an IAM design requirement, not a special case. Programmes that still assume a stable personal endpoint will continue to miss how frontline users actually work. Teams should expect governance pressure to shift toward device-aware access paths, consistent policy enforcement, and better visibility across operational contexts.
For practitioners
- Map access paths by workflow and device class Inventory how users actually authenticate on shared workstations, mobile devices, operational technology, and connected devices, then identify where access varies by location or user type.
- Unify PAM and access governance Treat privileged access security as part of the same governance model as routine access so vendors, employees, and internal administrators follow the same visibility and approval logic.
- Embed authentication in critical workflows Move from stand-alone login controls to authentication that sits inside the workflow for regulated tasks, so access checks happen where work is performed.
- Review third-party access alongside employee access Apply the same governance standards to external vendors and internal users when they touch regulated systems, especially where shared devices and privileged functions overlap.
Key takeaways
- Regulated workflows need access controls that fit shared devices, frontline tasks, and privileged operations, or users will work around them.
- The central issue is governance consistency across user types and device classes, not a false choice between speed and security.
- IAM and PAM teams should treat embedded authentication as a core workflow control because it moves access decisions closer to where regulated work happens.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST CSF 2.0, NIST SP 800-53 Rev 5, CIS Controls v8 and CSA Cloud Controls Matrix set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | The article centres on consistent access governance across users, devices, and regulated workflows. |
| Recommendation — Apply PR.AA-05 to standardise entitlements across shared devices and regulated workflow paths. | ||
| NIST SP 800-53 Rev 5 | IA-9 — Identification and Authentication (Non-Organizational Users) | Third parties and external users are explicitly part of the regulated access model discussed. |
| Recommendation — Use IA-9 to govern non-organizational access with the same auditability as internal access. | ||
| CIS Controls v8 | CIS-5 — Account Management | The article emphasises lifecycle consistency for employees, vendors, and privileged users. |
| Recommendation — Use CIS-5 to standardise account lifecycle controls across user categories and shared environments. | ||
| CSA Cloud Controls Matrix | IAM — Identity and Access Management | The cloud control domain aligns with identity governance spanning users, devices, and critical workflows. |
| Recommendation — Apply IAM domain controls to unify access policy, authentication, and privileged governance. | ||
Key terms
- Embedded Authentication: Authentication that is built directly into a workflow rather than handled as a separate step. In regulated environments, it reduces friction for users while keeping identity checks tied to the task, which helps preserve both speed and auditability across high-pressure operations.
- Shared-Device Access: An access pattern where multiple users authenticate through the same endpoint or workstation, often seen in healthcare and operational environments. It weakens simple one-user, one-device assumptions and requires stronger identity proofing, session control, and audit evidence to preserve accountability.
- Regulated workflow: A regulated workflow is any business process that performs an activity covered by law or licensing, such as customer onboarding, wallet custody, transfer approval, or sanctions screening. In crypto, the workflow itself must be mapped to the identities that can execute it and the rules that govern it.
- Privileged credential governance: The policies and operating controls that govern high-risk credentials such as tokens, API keys, and application secrets. Effective governance covers issuance, rotation, revocation, ownership, and auditability so that access can be removed cleanly when a vendor incident occurs.
Deepen your knowledge
NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.
Published by the NHIMG editorial team on June 24, 2026.
Updated on October 8, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org