TL;DR: Access reviews, audit responses, and governance decisions fail when teams assume identity data is accurate without independently verifying connectors, mappings, entitlements, and vault records, according to Hydden. That makes attestation a control for proving data integrity, not just completing a review, and the underlying assumption collapse matters for IAM, PAM, and NHI governance alike.
At a glance
What this is: This is an analysis of identity data attestation and the finding that access review outcomes are only as reliable as the identity data being certified.
Why it matters: It matters because IAM, IGA, PAM, and NHI programmes can all produce compliant-looking decisions on stale or incorrect data unless the source records are independently verified first.
Context
Identity data attestation is a governance control for verifying that the records feeding access decisions are accurate before anyone certifies them. In this article, the central problem is not whether a review was completed, but whether the data underneath the review was actually correct.
That distinction matters for IAM, IGA, PAM, and NHI governance because connectors, mappings, entitlements, and vault records can drift from the system of record without obvious failure. When the source data is wrong, the review process still looks complete while the decision itself rests on a false foundation.
Hydden's examples focus on proving data integrity across collection, comparison, and vault reconciliation. The typical starting position here is highly typical: many organisations assume the review artefact proves accuracy when it often only proves that someone clicked through the workflow.
Key questions
Q: What breaks when access reviews are the primary identity control?
A: The control breaks because access can change, be abused, and disappear between review cycles. Review-based governance produces documentation, but not continuous enforcement. In practice, that means investigators can find clean records even when the environment had excessive access at the exact moment the incident occurred.
Q: When does data accuracy become a governance problem rather than a technical one?
A: Data accuracy becomes a governance problem when multiple systems hold different versions of the same business fact and no one owns the authoritative record. At that point, the issue is not just correction, but accountability, decision rights, and agreed business definitions. Stewardship and MDM become necessary because technology alone cannot resolve meaning.
Q: What are the signs that identity data is out of sync across systems?
A: Common signs include role changes that appear in one directory but not another, offboarded users still present in at least one account store, and IdP lookups that return conflicting attributes. Those symptoms usually point to governance drift rather than a single broken login control.
Q: How should auditors evaluate evidence from completed access reviews?
A: Auditors should look for more than a returned spreadsheet. The stronger evidence is a durable record that shows the reviewed datasets, the configuration used to collect them, the reviewer who signed off, and the activity history behind the decision. That lets the examiner test whether the evidence itself was reliable.
Technical breakdown
Why access review data drifts from the system of record
Access review platforms often depend on connectors, field mappings, and periodic collection jobs that can fall out of sync with the source system. If the connector is misconfigured or stale, the review may show accounts, entitlements, or role memberships that no longer match reality. The technical failure is not the review workflow itself, but the data pipeline feeding it. That is why a clean approval trail can coexist with incorrect identity state: the decision engine is operating on an incomplete or outdated snapshot.
Practical implication: validate the collector, mapping, and source sync path before treating review output as authoritative.
How side-by-side reconciliation exposes governance drift
Attestation can compare what one system collected against what another system currently holds, field by field. That matters because drift is usually invisible in a single dashboard: one platform may show an account, role, or group as managed while the source of truth already changed. Side-by-side comparison forces discrepancies to surface in account presence, role names, and membership counts. This is a control for proving congruence between systems, not just recording an approval event.
Practical implication: use reconciliation views to catch stale entitlement data before it becomes an audit exception or access decision.
Why vault records still need independent verification
A PAM vault can rotate secrets and manage privileged credentials without proving that every vaulted account still belongs in the environment. Vault-managed accounts can outlive their ownership, source-system relationship, or governance status if they are not reconciled back to directory and application records. Attestation adds a review layer that checks whether the vault contents still map cleanly to real accounts. The key issue is identity truth, not secret storage: a vaulted credential is only defensible if the associated account is still valid and expected.
Practical implication: reconcile vaulted accounts against authoritative sources before certifying privileged access.
Threat narrative
Attacker objective: The objective is to preserve incorrect access or privileged records inside governance processes long enough for them to be approved and audited as if they were accurate.
- Entry occurs through incorrect connector data, stale mappings, or delayed collection that feeds the review with a false view of identity state.
- Credential or entitlement exposure follows when the platform certifies accounts, roles, or vault entries that no longer match the source system.
- Escalation happens operationally when audit, access, and governance decisions are made on the false assumption that the data has been independently verified.
- Impact is a defensible-looking review record that cannot prove the underlying identity state was accurate at the time of approval.
Breaches seen in the wild
- Azure Key Vault Contributor escalation 2024: Datadog found Azure Key Vault Contributor could add itself to access policies and read every secret, key and certificate in a vault.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Data attestation is a governance control, not a review feature. The point is not to speed up certification but to prove that the data being certified is correct before a decision is recorded. In practice, that moves attestation upstream of approval and makes data integrity part of the control objective. Organisations that treat review completion as evidence of correctness are confusing workflow completion with governance assurance.
Identity review processes fail when the collector, mapping, and source system are trusted as a single truth layer. Hydden's model shows that accuracy has to be confirmed at each step because a bad connector or stale mapping can make every downstream decision look legitimate. The implication is that governance teams need to question the provenance of the data, not just the approval outcome.
Vault assurance is about account validity, not only secret custody. A password manager or PAM vault can hold credentials that are technically managed yet still belong to accounts that no longer reconcile to the current environment. That is a different failure mode from secret leakage. Practitioners should therefore treat vault reconciliation as a distinct control domain, not a side effect of password rotation.
Identity data integrity is now a prerequisite for defensible access governance. Access reviews, audit responses, and entitlement decisions all inherit whatever quality exists in the upstream data chain. If the record is stale, normalised incorrectly, or missing relationships, the governance output is structurally weak even when the process is followed perfectly. The practical conclusion is simple: govern the data before you govern on the data.
Identity blast radius expands when certification happens without verification. The named concept here is the gap between what the platform believes and what the source system actually contains. That gap creates a false confidence window across IAM, IGA, and PAM programmes, because teams may be certifying a version of identity state that never existed in operational reality. The implication is that trust must be earned at collection time, not assumed at review time.
What this signals
Identity data attestation makes review quality measurable before approval, not after audit findings appear. That changes the governance model from proving that someone finished a task to proving that the task was based on correct source data. For IAM and IGA teams, the real question becomes whether the review artefact can defend the state it certified.
Vault reconciliation should sit beside access review, not underneath it. Privileged access is often treated as safe once it lives in a vault, but custody does not guarantee current validity. The control objective is to confirm that the vaulted account still exists, still belongs to the environment, and still maps back to an owner or source record.
Governance programmes need a data-trust checkpoint before certification cycles start. If mappings, connectors, and source records are allowed to drift silently, every downstream approval inherits that error. The stronger pattern is to force evidence of collection accuracy first, then let reviewers decide what is actually being certified.
For practitioners
- Verify collector and mapping integrity Test the connector configuration, attribute mappings, and collection scope before each certification cycle so the review is based on current source data rather than a stale snapshot.
- Reconcile governance views against source records Compare accounts, roles, memberships, and entitlement sets side by side between the governance platform and the authoritative system to surface drift before approval.
- Certify vault contents against authoritative sources Require PAM or password manager records to reconcile back to directory and application sources so vaulted accounts are only approved when ownership and existence still align.
- Freeze an evidentiary bundle for each completed review Retain the configuration, reviewed datasets, reviewer identity, and activity history so auditors can see exactly what data was certified and on what basis.
Key takeaways
- Identity attestation addresses a basic but often ignored problem: access reviews can be completed against incorrect identity data and still appear successful.
- The article's core evidence is operational rather than theoretical, showing how connector settings, mappings, source records, and vault contents can diverge from one another.
- The practical control lesson is to verify data integrity before approval so audits and governance decisions rest on reconciled records rather than assumptions.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 addresses the attack and risk surface, while NIST CSF 2.0, NIST SP 800-53 Rev 5 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-01 — Improper Offboarding | Stale vaulted accounts and unverified records behave like identity state that was never cleanly retired. |
| NHI-05 — Overprivileged NHI | The article shows how review data can overstate or misstate entitlement scope, creating hidden privilege risk. | |
| Recommendation — Reconcile dormant or stale accounts before certifying them to prevent inherited access from surviving in governance records. Validate entitlement mappings so approval decisions reflect actual privilege scope, not inflated collected data. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | The article is about proving that access records and entitlements are accurate before authorisation decisions are signed off. |
| Recommendation — Verify entitlements and authorisations against authoritative sources before certifying access decisions. | ||
| NIST SP 800-53 Rev 5 | AC-6 — Least Privilege | Incorrect identity data can cause least-privilege decisions to be based on stale or incomplete records. |
| Recommendation — Use least-privilege reviews only after the account and entitlement data has been independently reconciled. | ||
| CIS Controls v8 | CIS-5 — Account Management | Account inventory and lifecycle accuracy are central to the attestation workflow described here. |
| Recommendation — Maintain account inventories that reconcile cleanly to source systems before approving access reviews. | ||
Key terms
- Identity Data Attestation: A formal review process that asks a named reviewer to confirm that identity data is accurate before governance decisions are made. It turns source verification into durable evidence, so access reviews, audits, and privileged access checks rely on validated records rather than assumed correctness.
- Connector Drift: Connector drift is the mismatch that appears when a connected source changes its schema, API, or entitlement structure but the integration does not keep up. The result is either broken collection or silent data degradation, which is more dangerous because the system can still appear governed.
- Vault Reconciliation: The process of comparing vaulted privileged accounts against authoritative directory or application sources to confirm they still exist, still belong, and are still expected. For privileged access governance, reconciliation is what turns vault custody into defensible control evidence.
Deepen your knowledge
NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.
Published by the NHIMG editorial team on August 19, 2026.
Updated on October 12, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org