TL;DR: Identity remains the most common attack surface in incident response, and the article argues that granular, identity-based access controls depend on visibility, context, and enforcement across users, machines, applications, and AI agents, according to Zero Networks. The practical lesson is that least privilege is not a policy statement; it fails when organisations cannot see, scope, and continuously verify reachability.
At a glance
What this is: Zero Networks argues that identity-based access controls fail in practice when visibility, identity context and enforcement are missing across users, machines, applications and AI agents.
Why it matters: For IAM, PAM and NHI teams, the message is that least privilege is only meaningful when reachability can be observed and continuously enforced, not merely documented.
By the numbers:
- Identity remains involved in almost 90% of incidents investigated for the 2026 Unit 42 Global Incident Response Report, according to Zero Networks.
- 99% of cloud users, roles and services hold excessive permissions, according to Zero Networks.
- Some cloud users, roles and services go unused for 60 days or more, according to Zero Networks.
Context
Identity-based access control means access decisions are tied to who or what the requester is, not just to network location or static rules. In this article, the problem is not the concept itself, but the gap between policy intent and real enforcement across users, machines, applications and AI agents.
Zero Networks frames that gap through visibility and continuous enforcement. The core governance issue is that organisations often know what they want least privilege to mean, but they do not have enough live context to prove whether an identity should still be able to reach a given asset or service.
Key questions
Q: What breaks when identity-based access controls do not have live visibility?
A: Without live visibility, teams cannot tell which identities should still be allowed to reach which assets, so least privilege becomes a static claim rather than a working control. The result is overexposure, weak audit evidence and a much larger lateral movement surface when credentials are abused.
Q: Why do excessive permissions create so much risk in Zero Trust programmes?
A: Excessive permissions expand the number of paths an attacker can use after the first compromise. Zero Trust reduces trust in the network, but it does not help if an identity can already reach too many systems. Overprivilege turns every identity event into a potential lateral movement opportunity.
Q: What are the signs that identity governance is failing at the network layer?
A: Common signs include unclear communication flows, broad access that remains unused for long periods, and teams that cannot explain why a user, workload or agent can still reach a given service. Those symptoms show that entitlement records and real enforcement have drifted apart.
Q: How should teams govern non-human identities in AI-heavy environments?
A: Teams should govern non-human identities the same way they govern other privileged assets: assign ownership, minimise scope, rotate credentials regularly, and monitor for abnormal use. The key difference is speed. AI-driven workflows can exploit exposed access quickly, so detection and revocation must be automated and tied to lifecycle controls.
Technical breakdown
Why role-based access control fails at the network layer
Role-based access control becomes difficult once it is pushed into network-level reachability because the control depends on accurate scope, identity context and live state. If teams cannot see which users, machines and applications are communicating, they cannot reliably map roles to allowed paths. In practice, this makes static network policy brittle. The issue is not the RBAC idea itself, but the loss of enforcement fidelity when it must operate across dynamic environments, multiple identity types and changing workloads.
Practical implication: build identity-aware enforcement around observed communication patterns rather than assuming roles alone can express reachability.
Least privilege depends on visibility, not policy statements
Least privilege is often treated as an entitlement model, but the article shows it is really an enforcement model. To make it work, security teams need traffic visibility, identity context and a way to translate both into reachable paths. That is why the article points to learning and analysis tools that observe what each entity does and then constrain access accordingly. Without that breadcrumb trail, entitlement reviews remain descriptive, not control-effective, because no one can prove whether access still matches need.
Practical implication: treat observability of communication flows as a prerequisite to entitlement governance, not a separate monitoring project.
AI agents and unmanaged reachability expand the enforcement gap
The article extends the access-control problem beyond human users and servers to AI agents, which many organisations cannot inventory confidently. That matters because identity-based controls fail when teams do not know what is talking to what, or which applications and agents are using a machine at runtime. For autonomous or semi-autonomous software, the governance problem shifts from static assignment to runtime reachability. A control plane that ignores these subjects will miss both shadow AI and overexposed machine access.
Practical implication: include AI agents and machine identities in the same visibility model you use for users and workloads.
Threat narrative
Attacker objective: The attacker aims to turn trusted identity paths into lateral movement channels that expand access beyond the original foothold.
- Entry begins when overprivileged identities already present in the environment are able to authenticate and communicate beyond their intended scope.
- Escalation occurs when missing visibility prevents teams from recognising which identities should not be reaching servers, applications or network assets.
- Impact follows when excessive permissions and unverified reachability allow lateral movement and broader breach containment failure.
Breaches seen in the wild
- Amazon Q Developer extension compromise 2025: An over-scoped CI token let an attacker ship a prompt telling Amazon Q's AI coding agent to wipe files and AWS resources (CVE-2025-8217).
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Identity-based access control is only as strong as the organisation's ability to observe live reachability. The article correctly shifts the discussion away from policy language and toward enforcement conditions. If security teams cannot see current communication paths across users, machines, applications and agents, least privilege remains an assertion rather than a control. That makes visibility the precondition for any credible identity-first architecture.
Least privilege becomes an enforcement problem, not a permission-design problem. The article's real contribution is showing that role logic is not enough once identities operate across dynamic workloads and mixed runtime contexts. A role may describe intent at provisioning time, but the control fails if it cannot continuously verify whether that intent still matches actual communication. Practitioners should treat entitlement governance and network enforcement as one system.
Shadow AI turns access governance into an inventory problem as much as an authorisation problem. The article's mention of AI agents is important because identity programmes now need to account for software actors that many teams cannot enumerate with confidence. This is a governance gap, not just a tooling gap. If organisations cannot answer which agents are active and what they can reach, they cannot claim complete reachability control.
Identity blast radius is the real metric Zero Trust programmes should optimise. The article points toward a practical standard: how far a compromised identity can move before enforcement stops it. That framing is more useful than debating perimeter versus identity as abstractions. The practitioner test is whether access controls reduce reachable assets in real time, not whether a policy exists on paper.
Visibility and enforcement must be evaluated together, or both fail in production. The article shows why organisations that focus only on policy authoring often end up with unaudited overexposure. A control can be well-defined and still ineffective if it cannot be enforced at the point of communication. For identity governance leaders, the conclusion is clear: measure actual blocked paths, not just documented permissions.
From our research library:
- 90% of IT leaders say properly managing NHIs is essential for a successful zero-trust implementation, according to the Ultimate Guide to NHIs.
- Read next: Ultimate Guide to NHIs — Key Research and Survey Results
What this signals
Identity blast radius is now a governance metric, not just an incident metric: programmes should measure how far an identity can reach before enforcement stops it. If reachability is still broader than task need, least privilege is not operating as a control.
The practical shift is from entitlement review to communication control. Teams need a live map of who and what talks to what, otherwise access reviews will continue to certify stale permissions instead of reducing real exposure.
For practitioners
- Map real communication paths Inventory which users, workloads, applications and AI agents actually talk to each other before trying to authorise them by role alone.
- Tie policy to live identity context Use observed identity context to decide whether a connection should be allowed, rather than relying only on static group membership or entitlement records.
- Reduce excessive permissions first Prioritise identities with broad, unused or stale reachability, because those are the paths most likely to bypass least privilege in practice.
- Include AI agents in access inventory Extend the same reachability review process to AI agents and other software identities so shadow usage does not sit outside enforcement.
Key takeaways
- The article's central problem is not whether identity-based access control exists, but whether visibility and enforcement are strong enough to make it real in production.
- The source cites almost 90% incident involvement for identity and 99% excessive permissions in cloud environments, which shows the gap is widespread rather than edge-case.
- Security teams should measure and reduce identity blast radius by governing live reachability across users, workloads, applications and AI agents.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 and MITRE ATT&CK address the attack and risk surface, while NIST CSF 2.0 and NIST Zero Trust (SP 800-207) set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-05 — Overprivileged NHI | The article centres on excessive permissions and reachable scope across non-human identities. |
| NHI-10 — Human Use of NHI | The article warns that humans and software actors alike need governed access paths. | |
| Recommendation — Reduce standing reachability for non-human identities and verify that every path is still required. Separate human and machine use of identity so shared credentials do not blur accountability. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | The article is fundamentally about entitlement scope and continuous enforcement. |
| Recommendation — Continuously review and enforce access permissions against current business need and observed use. | ||
| NIST Zero Trust (SP 800-207) | Section 3.2 — Continuous Verification | The article directly relies on never-trust, always-verify behaviour for identity-based control. |
| Recommendation — Apply continuous verification before allowing an identity to reach sensitive assets. | ||
| MITRE ATT&CK | TA0006;TA0008 — Credential Access; Lateral Movement | The article frames identity misuse as the path to lateral movement after access is overextended. |
| Recommendation — Map overprivileged identity paths to credential access and lateral movement detection priorities. | ||
Key terms
- Identity-based control: An identity-based control ties access, approval, or execution to a specific user, role, or privileged account. This creates an audit trail that links behaviour to accountability, which is essential when governance must be proven across multiple systems.
- Identity Blast Radius: The amount of damage a compromised identity can cause across systems, data, and infrastructure. In NHI environments, it is shaped by permissions, network reach, and administrative capability rather than by the credential alone. Reducing blast radius is a containment strategy that limits lateral movement and data exposure.
- Reachability enforcement: The act of limiting which systems an identity can actually contact at runtime. It goes beyond policy documentation by turning identity context, observed traffic and trust decisions into blocked or allowed communication paths.
- Continuous Verification: A Zero Trust practice that re-evaluates trust during the session instead of relying on a single successful login. The control is stronger when context signals are available in real time and when the identity programme can act on those signals without creating excessive exceptions.
Deepen your knowledge
NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.
Published by the NHIMG editorial team on July 10, 2026.
Updated on October 11, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org