Identity-centric zero trust needs inline enforcement, not just governance

At a glance

What this is: Saviynt's partnership update argues that identity-centric zero trust fails when governance decisions are not enforced inline at session start, allowing standing privilege and persistent credentials to linger.

Why it matters: IAM, PAM and NHI teams need to close the gap between approval and enforcement or JIT access will remain a paper control rather than a runtime constraint.

Context

Identity-centric zero trust depends on identity decisions being enforced at the moment access begins, not only approved in an access workflow. When governance and enforcement sit in separate layers, time-bound privileges can survive longer than intended and standing access becomes the default operating model.

Saviynt's announcement frames that gap around just-in-time access, third-party onboarding and privileged lifecycle visibility across users, applications and infrastructure. The same governance problem shows up across human, non-human and AI-driven access when expiry, revocation and session control are not tied together.

Key questions

Q: What breaks when zero trust governance is not enforced at session start?

A: The control that breaks is the link between approved entitlement and usable access. If governance approves least privilege but the runtime session is not constrained, standing privilege survives in practice. That creates a mismatch between policy and enforcement, which is exactly where identity-centric zero trust loses its value.

Q: Why do time-bound privileges still leave risk if revocation is not inline?

A: Because the risk is not only how long access is approved for, but whether the session layer actually honors that expiry. If a privileged session can continue after the intended window, JIT becomes a label on top of persistent access. Inline revocation makes the time boundary real.

Q: How should security teams govern third-party identity access?

A: Security teams should inventory every external identity path, assign an internal owner, and apply scope, expiry, and revocation rules to each connection. Third-party access should be treated like privileged access, not like a static vendor checkbox. Continuous review matters because partner systems can become live identity dependencies long after onboarding.

Q: What is the difference between governance approval and inline enforcement?

A: Governance approval decides whether access should exist. Inline enforcement decides whether that access can actually be exercised in the session. Zero trust needs both, because an approved privilege that is not enforced at runtime still creates exposure.

How it works in practice

Why governance-only zero trust leaves standing privilege behind

Zero trust architectures assume access is continuously verified, but that assumption fails if governance decisions are not carried through to the runtime session. In practice, identity teams may approve least privilege in an IGA or PAM workflow while the network or access layer still allows a broader session to persist. The result is a split control plane: policy says one thing, enforcement does another. That is especially dangerous where tickets, VPNs, group memberships and persistent credentials are treated as equivalent paths to access. Practical implication: align entitlement issuance with session-level enforcement so the runtime state matches the approved state.

Practical implication: connect approval, provisioning and session enforcement so runtime access cannot drift beyond the decision.

How just-in-time access changes privileged lifecycle control

Just-in-time access is not only about shorter credentials. It changes the lifecycle of privilege by making access time-bound, policy-validated and automatically revoked after use. That matters because the attack surface in many enterprises still includes durable privileges that were created for convenience and then forgotten. If the revocation event is not enforced at the same boundary where the session starts, JIT becomes a paperwork exercise rather than a control. Practical implication: treat expiry as part of the access event, not as a later cleanup task.

Practical implication: enforce expiration at issuance and session start, not as a later lifecycle cleanup.

Why third-party access needs delegated controls and inline verification

Third-party access creates a governance problem because external users often sit outside the normal employee lifecycle while still needing constrained access to internal systems. The article's emphasis on onboarding, delegated controls and built-in expiration shows that third-party governance has to combine identity validation with real-time enforcement. Without that linkage, vendor access can outlive the business need, especially in cloud and AI-heavy environments where access paths are distributed. Practical implication: separate third-party entitlement handling from employee workflows and require inline policy checks before every privileged session.

Practical implication: apply dedicated onboarding, delegation and expiry controls to third-party access paths.

NHI Mgmt Group analysis

Identity-centric zero trust fails when approval and enforcement are split. The article describes a common control-plane failure: identity decisions are made in one system, while the session is governed elsewhere. That separation lets standing privilege survive even after a request has been formally approved, which weakens the very control zero trust is meant to provide. Practitioners should treat that split as a design defect, not a tuning issue.

Just-in-time access is only meaningful when revocation is enforced at the same boundary as issuance. If privilege can be granted and then persist beyond the intended session, the time-bound model collapses into ordinary standing access with a better label. That is why lifecycle visibility matters as much as policy intent. The practitioner conclusion is simple: expiry must be a runtime control, not an administrative afterthought.

Third-party access exposes the weakest point in identity governance because accountability is delegated but risk remains internal. The article's focus on onboarding, delegated controls and built-in expiration reflects a broader pattern: vendors and partners often inherit access paths faster than organisations can govern them. When that happens, the control gap is not visibility alone, but the absence of lifecycle discipline around external identities. Teams should separate third-party governance from employee access models.

Identity blast radius: Zero trust reduces risk only when privilege cannot persist outside its justified window. The value of inline enforcement is not merely better compliance, but smaller exposure when access decisions are wrong or stale. For identity programmes, the strategic question is whether access can be constrained at the moment of use, because that is where blast radius is actually decided.

From our research library:

• 97% of NHIs carry excessive privileges, increasing unauthorised access and broadening the attack surface, according to the Ultimate Guide to NHIs.
• 90% of IT leaders say properly managing NHIs is essential for a successful zero-trust implementation, according to the Ultimate Guide to NHIs.
• Read next: Just-in-Time Access and Zero Standing Privilege Guide

What this signals

Identity programmes are increasingly judged on whether they can control access at runtime rather than merely record a decision. When JIT, delegated access and session enforcement sit in different systems, the organisation inherits an approval trail but not a meaningful constraint on privilege.

Approval-to-enforcement gap: This is the failure mode to watch in identity-centric zero trust programmes. The more your controls depend on later reconciliation instead of inline enforcement, the more likely standing privilege is still operating underneath the policy layer.

For practitioners

• Tie approval to session start Ensure privileged access decisions are enforced inline when the session begins, so the approved scope is the only scope that can be exercised.
• Replace standing privilege with time-bound access Use just-in-time access for privileged tasks that do not require persistent credentials, and make revocation automatic at the end of use.
• Separate third-party lifecycle handling Create dedicated onboarding, delegation and expiration rules for partners and vendors instead of reusing employee access workflows.
• Audit the approval-to-enforcement gap Review where identity governance records say access is approved but enforcement layers still permit broader or longer-lived sessions.

Key takeaways

• Identity-centric zero trust weakens when governance decisions are not enforced at the point of session creation.
• The core risk is not merely over-approval but privilege that continues beyond its intended use.
• Inline enforcement and time-bound revocation are the controls that make JIT and zero standing privilege real.

Key terms

• Data-centric zero trust: A zero trust model that treats the data itself as the primary control boundary. Rather than relying mainly on network location or device trust, it asks whether a subject, workload, or AI system should access specific data for a specific purpose under current policy.
• Inline Enforcement: Inline enforcement is the technical act of applying access policy in the live session path, not just at approval time. It matters because identity governance without runtime enforcement can authorize access that the session layer never actually constrains, especially in distributed and third-party environments.
• Just-in-Time Access Request: Just-in-Time Access Request is a pattern that grants access only when it is needed and only for the duration required. It reduces standing privilege by making access temporary, policy driven, and task scoped. This approach is especially useful for contractors, sensitive systems, and short-lived operational work.
• Standing Privilege: Standing privilege is access that remains active even when no immediate task requires it. For NHI programmes, it is a common failure mode because long-lived credentials and persistent roles create unnecessary exposure. Reducing standing privilege usually means tighter expiry, on-demand access, and clearer review of who or what still needs access.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.