Identity and access management benefits are not enough without governance

At a glance

What this is: This is a governance-focused IAM explainer that argues access control benefits only materialise when organisations manage the full identity lifecycle, including role changes, access reviews, and offboarding.

Why it matters: It matters because IAM programmes that stop at authentication or role assignment leave privilege drift, delayed revocation, and review gaps that undermine both security and auditability.

Context

IAM is not just a login control. In practice, it is the set of processes and policies that decide who gets access, what level of access they receive, and when that access should change or end.

Zluri’s article centres on the gap between IAM’s promised benefits and the governance needed to make them real. The problem is not whether access can be granted centrally, but whether access stays aligned to roles, policies, and lifecycle events after it is granted.

Key questions

Q: What breaks when IAM governance is treated as a setup task?

A: IAM usually breaks at the point where access changes continue after launch but governance does not. Policies may look correct on day one, yet certifications, revocation, and monitoring drift as users, apps, and roles change. The result is a programme that appears implemented but no longer controls real access decisions.

Q: Why do role changes create access risk in IAM programmes?

A: Role changes often preserve old permissions while adding new ones, which creates privilege creep. If the access model does not remove prior rights at the same time it adds new entitlements, users can keep access that no longer matches their job. That is a least-privilege failure and a governance problem, not just an admin oversight.

Q: How do teams know if automated access reviews are actually working?

A: Automated reviews are working when exception rates fall, reviewer overrides become rare, and access decisions are grounded in clean role definitions rather than ad hoc exceptions. If certifications keep surfacing the same noisy entitlements, the problem is usually role design, not reviewer effort. Effective automation should reduce ambiguity, not scale it.

Q: What is the difference between IAM and identity governance?

A: IAM enforces access at runtime, while identity governance decides which access should exist in the first place and whether it remains appropriate. IAM handles authentication and permission checks. Governance handles policy, approvals, certifications, segregation of duties, and revocation. Both are needed, but governance is what makes access defensible to auditors and risk teams.

Technical breakdown

How IAM turns identity into access decisions

IAM works by combining authentication, authorisation, and lifecycle administration into one access control model. Authentication verifies that a person is who they claim to be, while authorisation determines which resources that identity can reach, often through role-based access control and policy rules. The operational value comes from centralising those decisions so administrators do not manage permissions application by application. That centralisation is only effective if identity data, role definitions, and access policies stay accurate as the business changes.

Practical implication: treat IAM as an access decision system that must be kept in sync with role and organisational change.

Why lifecycle management determines whether IAM actually works

Lifecycle management is where IAM succeeds or fails because access is rarely static. Joiners need the right access at onboarding, movers need entitlements adjusted when roles change, and leavers need access removed immediately when they depart. If those steps are delayed or incomplete, IAM still functions technically but no longer governs real privilege exposure. The article’s emphasis on offboarding and access revocation reflects a basic control truth: the value of IAM depends on whether entitlements match current business need, not historic assignment.

Practical implication: connect IAM to joiner-mover-leaver processes so entitlement changes happen when the business event occurs.

Access reviews are governance, not paperwork

Access reviews are meant to validate whether existing permissions still match job need, compliance requirements, and least-privilege expectations. They become weak when they are treated as a periodic formality rather than a decision point that drives revocation or adjustment. Zluri’s framing of audit and monitoring points to the same issue: visibility alone is not governance. Organisations need review outcomes that lead to real entitlement changes, otherwise dormant privileges and role drift remain in place after the review cycle ends.

Practical implication: make access review results actionable by tying every exception or excess entitlement to a removal or remediation step.

NHI Mgmt Group analysis

IAM value collapses when governance stops at access assignment: The article is right to separate IAM capability from IAM outcome. Centralised authentication and role control reduce friction, but they do not by themselves prevent privilege drift, delayed revocation, or stale entitlements. The practitioner lesson is simple: access control only governs risk when lifecycle events trigger actual entitlement change.

Offboarding is the control point that proves whether IAM is operational or cosmetic: The strongest benefit in the article is also the most commonly under-enforced in practice. If offboarding and role changes are not wired into the IAM process, the organisation still has a policy, but it does not have timely revocation. That gap is where audit findings and unnecessary exposure accumulate.

Access reviews only matter when they change the state of access: Periodic certification is often treated as evidence, but the real control objective is correction. If an access review does not remove excess privilege, it becomes a reporting exercise rather than governance. For practitioners, the question is not whether reviews exist, but whether they reliably reduce standing exposure.

Least privilege is a lifecycle property, not a provisioning event: The article repeatedly points to RBAC, permissions management, and adaptive access, but the durable insight is broader. Least privilege decays whenever role changes, temporary needs, or departed users are not reflected in entitlement state. Governance must therefore operate continuously, not only at initial grant.

Identity governance is the missing layer that converts IAM from control to discipline: IAM centralises access decisions, but governance defines whether those decisions remain defensible over time. That is why the practical boundary between IAM and IGA matters less than the operational reality: without recurring review, lifecycle offboarding, and policy enforcement, access control drifts away from business intent. Practitioners should measure the change in entitlement state, not the number of controls deployed.

What this signals

Governance is the difference between granted access and controlled access: IAM centralises the decision to grant permissions, but it does not guarantee those permissions will still be correct after a role change or departure. For practitioners, the signal is clear: if lifecycle events do not trigger entitlement updates, access control becomes stale immediately after provisioning.

Identity review must be tied to removal, not just visibility: Organisations often stop at discovering who has access, but discovery alone does not reduce exposure. The programme signal to watch is whether every review, recertification, or exception process feeds an actual entitlement change in downstream systems.

Access drift is the operational metric that matters most here: The article points to onboarding, offboarding, RBAC, and audit as connected pieces of one governance model. The practical takeaway for security teams is to measure how quickly permissions change after role events, because that is where IAM either becomes durable control or administrative theatre.

For practitioners

• Map IAM to lifecycle events Link onboarding, role changes, and offboarding to access changes so entitlements are updated when the business event occurs, not at the next review cycle.
• Automate access revocation on departure Remove access immediately when a user leaves or changes roles in a way that invalidates prior permissions, and verify that the revocation reaches all connected SaaS apps and directories.
• Turn access reviews into enforcement Require each review outcome to produce a tracked remediation action, especially where users retain permissions beyond current job need or policy intent.
• Measure privilege drift against role changes Compare current entitlements to approved role definitions so excess permissions show up as governance defects rather than background configuration noise.

Key takeaways

• IAM delivers value when authentication and role control are paired with lifecycle governance that keeps entitlements current.
• Offboarding, role changes, and access reviews are the control points that determine whether least privilege remains real after provisioning.
• Security teams should measure whether access decisions are being reversed or updated when jobs, responsibilities, or departures change.

Key terms

• Identity And Access Management: Identity and Access Management is the discipline of controlling who or what can access systems, data, and services. It covers identity lifecycle, authentication, authorization, provisioning, deprovisioning, and policy enforcement across users, devices, applications, and non-human identities, so access is granted only to approved entities under defined conditions.
• Role-Based Access Control: A model that grants permissions by assigning identities to predefined roles. It works well when jobs are stable and access patterns are predictable, but it becomes brittle when exceptions pile up. In practice, role design must stay small enough to audit and broad enough to avoid endless custom variants.
• Access Review: A formal process for confirming whether access is still needed and justified. In IAM programs, the review becomes an evidence-bearing control when decisions are recorded, scoped correctly, and traceable to the right reviewer, application owner, or auditor.
• Lifecycle Management: Lifecycle management is the process of creating, reviewing, rotating, and retiring identities and their secrets in a controlled way. For NHIs, it is essential because stale credentials, orphaned accounts, and incomplete offboarding are common paths to long-lived exposure and unauthorised access.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.