Identity context graphs make access decisions explainable

At a glance

What this is: A context-graph approach links identities, resources, policies, approvals, and exceptions so access decisions can be traced and explained.

Why it matters: IAM teams need explainability because access reviews, incident response, and audits fail when the reason for access is trapped in disconnected systems.

Context

Most enterprises can answer who has access, but not why that access exists. The governance gap is not a lack of identity data, but a lack of connected decision data that preserves approvals, exceptions, policy versions, and business justification across the access lifecycle.

An identity context graph treats those relationships as first-class governance data. For IAM, IGA, PAM, and non-human identity programmes, that changes the control model from isolated records to traversable evidence that can support review, investigation, and audit.

Key questions

Q: What breaks when approval history and policy versions are stored in separate systems?

A: Governance breaks because reviewers lose the ability to reconstruct the original decision with confidence. They may see that access exists, but not which policy applied, who approved the exception, or whether the approver still had authority. The result is manual correlation, weak evidence, and inconsistent review outcomes.

Q: How do identity context graphs improve access reviews in practice?

A: They give reviewers the context that spreadsheets strip away. Instead of approving entitlements in isolation, teams can see the approval chain, the exception path, and any policy changes since the last review. That turns the review into an evidence-based decision rather than a rubber stamp.

Q: How can organisations govern AI agents that use service accounts and tokens?

A: Treat those credentials as governed non-human identities with lifecycle controls, not as temporary developer conveniences. That means provisioning them with clear scope, monitoring how they are used, rotating them on a schedule, and removing them when the workflow ends. The goal is to keep the agent’s privilege bounded across its entire operating life.

Q: Who is accountable when a user still has access after their approval context has changed?

A: Accountability sits with the governance process that allowed the access trail to fragment. If approver authority, policy version, or exception ownership is not preserved, no reviewer can reliably determine whether the access remains valid. That is a governance design failure, not just an administrative miss.

Technical breakdown

How identity context graphs preserve access lineage

An identity context graph is a relationship model that connects identities, resources, entitlements, policies, approvals, exceptions, and business rules in one traversable structure. Instead of storing access as disconnected records in an identity provider, ticketing system, cloud console, and policy repository, the graph preserves the lineage of each decision. That matters because access is rarely granted by a single event. It is usually inherited, modified, approved, overridden, and revisited over time. When those links are explicit, practitioners can ask not only what access exists, but which policy version, approver, and exception created it.

Practical implication: model approval and exception lineage as governance data, not just metadata.

Why explainability changes access reviews and audit evidence

Traditional access reviews collapse context into a yes-or-no decision on entitlements, which leaves reviewers guessing about justification and risk. A context graph changes the review object itself: the reviewer sees the approval chain, policy state at the time of grant, and any later changes that affect validity. The same structure also makes audit evidence a byproduct of governance rather than a separate reporting exercise, because the system already knows how access was created and modified. That is the difference between reconstructing history after the fact and querying it directly.

Practical implication: use explainability to review the decision, not just the entitlement.

Why identity context graphs matter for agentic access

As AI agents request credentials and act across enterprise systems, the governance problem shifts from periodic certification to continuous decision traceability. Agentic access can move too quickly for manual review cycles, but the underlying requirement stays the same: every action must still be attributable to a governed identity and an authorised context. A context graph becomes the memory layer that lets policy decisions, exception history, and authority boundaries persist across human, machine, and agent-driven workflows. Without that memory, identity governance degrades as access becomes more dynamic.

Practical implication: extend graph-based governance to service accounts, workloads, and AI agents before access volume outpaces review capacity.

Threat narrative

Attacker objective: Exploit governance fragmentation so access can persist without a defensible decision trail.

1. Entry occurs when access is granted through a chain of approvals, exceptions, and inherited entitlements that is no longer visible as a single governance record.
2. Credential or privilege abuse follows when stale authority, deprecated policy, or an unrevoked exception continues to justify access after the original context has changed.
3. Impact is the inability to answer who approved access, under which policy, and whether that approval still stands, which weakens review, response, and audit confidence.

Breaches seen in the wild

• McKinsey AI platform breach: McKinsey AI platform hack exposed 46M chats and sensitive data.
• CoPhish OAuth phishing via Copilot Studio: Datadog showed Copilot Studio agents on a Microsoft domain can front OAuth consent phishing and forward stolen tokens; no victims reported.

Read our 52 NHI Breaches Analysis report for a comprehensive view of breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Identity context graphs turn access governance from record keeping into decision lineage. Most identity programmes can inventory entitlements, but they cannot reliably explain how a specific grant was justified, who approved it, or whether the approval still carries authority. That gap matters because governance without lineage is only partial control. The practitioner conclusion is that explainability must be built into the access model itself, not assembled afterward.

The real governance failure is context fragmentation, not lack of identity tooling. When approval history sits in one system, policy versions in another, and exceptions in a third, the organisation loses the ability to answer basic audit and review questions without manual reconstruction. That is not a reporting inconvenience; it is a control boundary problem. The practitioner conclusion is that identity governance needs a unified decision trail, not another spreadsheet process.

Identity explainability becomes a control requirement in the agentic era. As machine and AI-driven identities request and use access faster than human reviewers can inspect it, the question is no longer whether a reviewer can sign off, but whether the system can preserve why access existed at all. That applies equally to human, workload, and AI agent governance. The practitioner conclusion is to treat traceable context as core identity infrastructure.

Identity context graph is the right named concept for this shift. It is the governed, queryable structure that preserves the why behind access decisions across policies, approvals, exceptions, and business rules. That concept matters because it reframes identity from a list of accounts into a living decision system. The practitioner conclusion is to measure governance maturity by decision traceability, not by the number of entitlements reviewed.

Access review quality will increasingly depend on decision context, not reviewer effort. The harder teams work inside a fragmented model, the more they compensate for a missing evidence layer that should already exist. A context graph reduces the need for inference by making the approval chain, policy state, and exception path visible at query time. The practitioner conclusion is to design reviews around evidence retrieval, not tribal knowledge.

From our research library:

• Enterprise AI use rose from 55% of organisations in 2023 to 88% in 2025, according to McKinsey’s Global Surveys on the State of AI.
• Read next: Identity Security Programme Guide

What this signals

Identity context graph: this is the governed memory layer that identity programmes have been missing. It makes approvals, exceptions, and policy versions queryable at the moment a reviewer, auditor, or incident responder needs them, which is why it matters across human, machine, and AI agent identities.

The operational shift is from reconstructing evidence after the fact to preserving decision context as part of the access model. That should change how teams think about IGA maturity, because the control is no longer only whether access exists, but whether the organisation can still explain the authority behind it.

For practitioners

• Map approval lineage into one governed structure Connect identities, entitlements, policies, approvals, and exceptions so reviewers can trace why access was granted and under what authority.
• Preserve policy version history with each access grant Record which policy version was active when access was approved so later reviews can judge the grant against the correct rule set.
• Treat exceptions as first-class governance objects Track business justification, approver authority, and expiry for every exception instead of leaving those details in tickets or chat threads.
• Use the same decision trail for audits and incident response Build the evidence path once and reuse it for reviewer context, forensic reconstruction, and audit requests without rebuilding history manually.
• Extend the model to machine and agent identities Apply the same traceability requirements to service accounts, workloads, and AI agents so dynamic access does not outgrow governance capacity.

Key takeaways

• Access governance fails when the reasons for a grant are scattered across multiple systems instead of preserved as decision data.
• The practical value of a context graph is faster review, faster forensic reconstruction, and cleaner audit evidence.
• Identity programmes that extend the same lineage model to service accounts and AI agents will be better positioned for the agentic era.

Key terms

• Security Context Graph: A Security Context Graph is a relationship model that connects users, assets, identities, and behaviour so alerts can be judged against known organisational context. It helps investigators distinguish unusual activity from expected operations by adding ownership, access, and workflow information to raw telemetry.
• Decision Lineage: Decision lineage is the traceable record of how an access decision was made, including the inputs, policy checks, risk signals, and approver rationale. It goes beyond an approval log by showing why access was granted and how the organisation can defend the choice later in audit or review.
• Explainable Access Administration: Explainable access administration means access decisions can be traced to a policy, a reason, and an accountable owner. This matters because AI-assisted or delegated administration can become opaque unless the programme preserves decision provenance and challengeability.
• Governed Context: The approved business meaning, labels, and boundaries that shape how an AI system interprets data before acting on it. When context is governed, the organisation is not only controlling access to information, but also controlling what the system can infer, combine, and operationalise from that information.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.