Identity and access governance now spans workforce and non-human identities

At a glance

What this is: This analyst report frames identity and access governance as a cross-ecosystem control problem that now includes human and non-human identities alike.

Why it matters: It matters because IAM teams need governance models that scale from employees to workloads, APIs, and bots without losing control over certification, policy enforcement, and accountability.

By the numbers:

• 72% of organisations have experienced or suspect they have experienced a breach of non-human identities, with 46% confirmed and 26% suspected.

👉 Read Pathlock's analyst coverage of identity and access governance leaders

Context

Identity and access governance is the discipline that decides who or what should have access, what that access should look like, and how often it should be reviewed. In distributed environments, that question now applies to workforce identities, privileged accounts, applications, APIs, workloads, bots, and other non-human identities, which makes governance a multi-actor problem rather than a human-only review exercise.

The Pathlock article is best read as a market signal about where IAG is heading: access certification, entitlement management, segregation of duties, policy enforcement, and risk analytics are no longer isolated controls. They have to function across a broader identity estate, where lifecycle, exception handling, and auditability become harder as more access is created outside traditional human joiner-mover-leaver workflows.

For identity teams, the main issue is not whether governance exists, but whether it still works when the governed subject is a service account, workload, or bot rather than a person. That is where certification cadence, entitlement sprawl, and policy enforcement tend to break down first.

Key questions

Q: How should organisations govern non-human identities alongside employee access?

A: Organisations should govern NHIs with the same discipline used for human access, but with stronger lifecycle ownership and expiry controls. That means inventorying service accounts, tokens, certificates, and agents, assigning business ownership, and tying every entitlement to a documented purpose. Governance is incomplete if machine access cannot be approved, certified, and removed on demand.

Q: Why do access certification processes often fail for workloads and service accounts?

A: Because certification workflows were designed around people, managers, and job changes, not identities that persist independently of employment cycles. When the subject is a workload or service account, the review must be tied to technical ownership, entitlement scope, and lifecycle events instead.

Q: What do security teams get wrong about entitlement management in distributed environments?

A: They often treat entitlements as platform-specific records instead of a governed inventory spanning cloud, SaaS, infrastructure, and APIs. That creates blind spots, duplicate privileges, and review fatigue because no one can see the full access picture at decision time.

Q: What frameworks help align NHI governance with modern identity security?

A: The most relevant starting points are the NIST Cybersecurity Framework 2.0 for governance structure and the NHI governance guidance in the Ultimate Guide to NHIs for lifecycle, visibility, and rotation. Together they help teams map ownership, access review, and revocation across machine and human identities.

Technical breakdown

Why identity and access governance now spans non-human identities

Identity and access governance has traditionally been built around workforce users and periodic review cycles. That model breaks down when applications, APIs, workloads, and bots also carry entitlements that can create material risk. Once those identities are part of the operating model, governance must cover certification, ownership, policy enforcement, and exception handling across systems that do not follow human employment lifecycles. The practical challenge is not simply volume. It is whether access can still be rationalised, explained, and revalidated when the subject is a machine identity with no manager or job title.

Practical implication: Map every non-human identity to an accountable owner and review path before access review processes expand into the machine estate.

Access certification and entitlement management at machine scale

Access certification asks whether current access is still justified. Entitlement management defines what access exists in the first place. For non-human identities, both controls become harder because privileges are often inherited through service accounts, application dependencies, or automated provisioning. If access rights are not normalised into a governed catalogue, certification becomes a box-ticking exercise that confirms existing sprawl instead of reducing it. This is why identity governance platforms now compete on whether they can model machine identities, not just human roles.

Practical implication: Normalise entitlements for service accounts, workloads, and APIs before the next certification campaign so reviewers can evaluate actual risk, not opaque permissions.

Segregation of duties and policy enforcement across distributed environments

Segregation of duties works only when a policy engine can see which identities combine high-risk capabilities. In distributed environments, that means correlating access across applications, infrastructure, and cloud services, not just across business roles. Policy enforcement also has to be continuous enough to catch exceptions as they emerge, rather than relying on periodic reviews alone. For NHI governance, that is where integration with the broader security ecosystem matters, because identity decisions often need context from cloud, endpoint, and audit signals before they can be enforced cleanly.

Practical implication: Use policy correlation across systems of record and runtime signals so high-risk combinations are identified before they become persistent access patterns.

Threat narrative

Attacker objective: The objective is to exploit governance blind spots in the identity fabric so excessive or unreviewed access persists across systems.

1. Entry occurs when distributed identities such as applications, APIs, workloads, and bots are introduced into the governance perimeter without equivalent lifecycle controls. Escalation follows when entitlements accumulate faster than certification and policy enforcement can correct them. Impact appears as access risk, audit gaps, and weak accountability across the identity estate.

Breaches seen in the wild

• Cisco DevHub NHI breach — IntelBroker exploited exposed Cisco credentials, API tokens and keys in DevHub.
• Meta AI Instagram Account Takeover — 20,225 Instagram accounts hijacked via compromised Meta AI support chatbot with overprivileged access.

Read our 52 NHI Breaches Analysis report for a comprehensive view of breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Identity and access governance is no longer a human-only discipline. The article reflects a structural change in the identity estate: applications, workloads, APIs, and bots now sit inside the same governance perimeter as workforce users. That widens the scope of certification, entitlement management, and policy enforcement without changing the underlying governance obligation. The practitioner takeaway is that IAG programmes must be designed for actor diversity, not just user populations.

Access certification fails when the governed subject has no employment lifecycle. Certification workflows were built for people whose access can be tied to managers, roles, and time-bound job changes. That assumption breaks for service accounts and workload identities, which often persist beyond the process that created them. The implication is that governance teams need ownership models that are identity-specific, not HR-specific.

Entitlement sprawl is the real control problem behind distributed governance. Once access rights are scattered across applications, infrastructure, and cloud services, reviewers cannot certify what they cannot normalise. Pathlock’s framing matters because IAG value now depends on whether entitlement data is coherent enough to support decision-making. Practitioners should treat entitlement inventory quality as a governance prerequisite, not an implementation detail.

Policy enforcement must move closer to runtime context. Periodic review alone cannot resolve access risk in distributed systems where entitlements change continuously. Identity governance has to coordinate with the wider security stack so exceptions, privilege combinations, and SoD conflicts are visible early. The field is moving toward governance that is continuous in effect even if review remains periodic in process.

NHI governance blind spots: The most important change is that machine identities are now part of the governance baseline, not a separate hygiene problem. That shifts the question from whether an organisation has IAG to whether its IAG model can actually govern identities that are not people. Teams that keep machine access outside core governance will keep finding the same gap in different systems.

From our research:

• 85% of organisations lack full visibility into third-party vendors connected via OAuth apps, and 47% have only partial visibility, according to The State of Non-Human Identity Security.
• Only 1.5 out of 10 organisations are highly confident in their ability to secure NHIs, compared to nearly 1 in 4 for securing human identities.
• NHI Lifecycle Management Guide is the right next step when governance needs to move from access visibility to ownership, rotation, and offboarding.

What this signals

Identity governance teams should assume that machine identities will keep expanding faster than review processes can adapt. The key signal is whether entitlement data is clean enough to support certification at scale, because noisy inventories turn governance into paperwork. Teams that can link machine ownership, entitlement scope, and runtime context will be better placed to keep access review useful as the identity estate grows.

Governance maturity now depends on whether the programme can span human and non-human identities without splitting control models. A separate process for service accounts usually becomes a second-class control surface. The more effective pattern is a single governance fabric with actor-specific workflows, because that preserves auditability while avoiding duplicate policy logic.

With 85% of organisations lacking full visibility into third-party vendors connected via OAuth apps, the next governance failure is often not missing policy but missing context. That is why identity programmes need to strengthen inventory, ownership, and certification evidence before they can claim control over distributed access.

For practitioners

• Inventory non-human identities with named ownership Build a single register for service accounts, APIs, workloads, and bots, and require an accountable owner for every entry. Without ownership, certification and exception handling will keep failing because no one can attest to the access.
• Normalise entitlements before certification cycles Translate raw permission sets into business-readable entitlement records so reviewers can see what access exists and why it matters. This makes access certification useful instead of merely procedural.
• Correlate segregation of duties across systems Check for toxic combinations across applications, cloud services, and infrastructure rather than inside one platform at a time. Distributed entitlement data creates hidden SoD conflicts that isolated reviews miss.
• Tie policy enforcement to runtime context Feed governance decisions with cloud, audit, and security telemetry so access exceptions are visible while they still matter. That is the difference between scheduled review and effective control.

Key takeaways

• Identity and access governance now has to cover workforce users, machine identities, and automated access paths in one model.
• Certification and entitlement management lose value quickly when service accounts and workloads are not mapped to accountable ownership.
• Practitioners should prioritise inventory quality, policy correlation, and runtime context before expanding governance scope further.

Key terms

• Federated Identity Access Governance: A control model that separates policy setting from operational approval and evidence collection. Central teams define access rules and risk thresholds, while business owners make decisions within those guardrails and an independent platform records what happened for audit and review.
• Entitlement Management: Entitlement management is the practice of controlling what an identity is allowed to access, use, or change. For NHIs, it is the preventive layer that limits privilege sprawl, reduces standing access, and makes any later detection or response more effective.
• Access Certification: Access certification is the periodic review of whether an identity still needs its current entitlements. For NHIs, certification is only reliable when reviewers know the identity's owner, purpose, and expiry, otherwise stale machine access can persist long after the original use case has ended.
• Segregation of Duties: Segregation of Duties is a control principle that prevents one person or role from combining incompatible permissions that could create fraud, error, or undetected change. In ERP environments, it must account for roles, transactions, approvals, and compensating controls across business processes.

What's in the full article

Pathlock's full analysis covers the operational detail this post intentionally leaves for the source:

• The analyst scoring criteria used to evaluate identity and access governance vendors across access certification, entitlement management, and policy enforcement.
• The capability breakdown behind automation, risk analytics, and integrations that matter when governance spans apps, APIs, workloads, and bots.
• The market comparison lens used by KuppingerCole Analysts when ranking IAG vendors for distributed identity environments.

👉 Pathlock's full page includes the analyst report context and the capability areas used in the IAG evaluation.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.