TL;DR: Relying on a primary directory for enterprise-wide security leaves entitlement decisions, non-native applications, and non-human identities under-governed, according to SailPoint. The real risk is not login failure but control drift across human and machine identities, where static reviews and SSO coverage cannot enforce least privilege or separation of duties.
At a glance
What this is: This blog argues that directory-centric security leaves entitlement governance, non-native applications, and NHI coverage fragmented across the enterprise.
Why it matters: IAM and governance teams need a model that controls entitlements and lifecycle decisions across humans and NHIs, not just sign-in events in the primary directory.
By the numbers:
- 71% of organizations suffered from at least one identity-related breach in the past year, according to SailPoint.
- 60% of organizations state that non-human identities pose a greater risk to their operations than human users, according to SailPoint.
Context
Identity governance becomes a control issue when the tools that prove sign-in do not govern what an identity can actually do across applications. Directory coverage can confirm authentication, but it often leaves entitlements, toxic access, and separation-of-duties checks outside the governed path.
This matters because modern enterprise identity spans human users, service accounts, API keys, and AI agents. When governance stops at the directory boundary, access drift accumulates in the systems where risk is created, not where login is validated.
Key questions
Q: What breaks when identity governance stops at the primary directory?
A: Governance becomes partial because authentication is visible while effective permissions remain hidden inside non-native applications. That leaves teams unable to certify, recertify, or remove toxic access with confidence. The practical result is an identity programme that can prove who signed in, but not what authority they actually exercised.
Q: Why do non-SCIM applications create identity governance risk?
A: Non-SCIM applications create risk because they force organisations into custom integration patterns that are harder to standardise, review, and decommission. Every bespoke connector adds another place where provisioning, group membership, or offboarding can drift from policy. The issue is not the application type alone, but the loss of a consistent lifecycle control path.
Q: What problem does ownership attribution solve for service accounts and API keys?
A: It closes the gap between exposure detection and accountable remediation. Many organisations can find the secret, but not the human who introduced it, maintains it, or can safely replace it. Ownership attribution gives security teams a practical way to assign action without relying on informal knowledge that disappears during staff changes.
Q: What should organisations do when SSO coverage looks complete?
A: They should verify whether the integration provides entitlement-level governance or only authentication. A broad SSO footprint can hide the fact that permissions, toxic combinations, and separation of duties remain unmanaged in the target application. Coverage claims are only useful when they reach the permission layer.
Technical breakdown
Why account governance stops short of entitlement control
Account governance is about verifying that an identity can sign in and has a valid account state. Entitlement control is different: it governs the permissions, roles, and action rights that determine what a user or workload can actually do inside an application. In non-native systems, a directory may know the account exists but still have no reliable view of transaction rights, record-edit privileges, or toxic combinations of access. That gap forces teams into spreadsheets and custom scripts because the authoritative control point is not the directory itself. Practical implication: treat login coverage and entitlement governance as separate control problems.
Practical implication: separate sign-in coverage from entitlement governance and build controls for both.
Why SSO coverage does not equal governance coverage
Single sign-on reduces friction by centralising authentication, but it does not automatically expose role depth, application-specific permissions, or downstream privilege combinations. The article’s point is that many integration counts are really SSO counts, not governance depth. That distinction matters because a system can be easy to access and still be opaque from an entitlement perspective. In practice, the riskiest applications are often the ones that appear connected while remaining poorly governed. Practical implication: validate whether each integration supports entitlement-level review, not just authentication.
Practical implication: verify that each integration supports entitlement-level review, not just authentication.
How non-human identities expose the directory model's blind spot
Service accounts, API keys, and AI agents do not fit a human-centric lifecycle model that assumes manual onboarding, periodic review, and stable ownership. These identities can outnumber human users and can be created, copied, or left in place faster than directory-centric governance can absorb. If the control model only understands people and their accounts, then machine identities remain under-governed by design. This is where the governance problem becomes structural, not operational. Practical implication: extend governance so it can inventory, classify, and review non-human identities with the same seriousness as user accounts.
Practical implication: extend governance to inventory and review non-human identities with the same rigour as user accounts.
NHI Mgmt Group analysis
Directory-centric governance creates a false boundary around enterprise identity. The article shows that sign-in control is not the same as entitlement control, especially in non-native applications where permissions live outside the directory's line of sight. That separation matters because the control gap is not just technical, it is organisational: the identity programme believes it has coverage when it only has authentication. Practitioners should treat the directory as an access entry point, not the system of record for governance.
Non-human identities are the clearest proof that a human lifecycle model no longer fits the enterprise. Service accounts, API keys, and AI agents are governed differently from employees, yet many identity programmes still force them into controls designed for human users. That mismatch produces unmanaged risk in the places where automation is fastest and review cycles are slowest. The implication is that lifecycle governance has to be identity-type aware, or it will under-govern the identities that move the most.
Governance velocity is now a control requirement, not an efficiency feature. Static reviews and chart-based recommendations lag behind how access is actually used, which is why toxic privilege persists between certification cycles. A programme that cannot see real entitlement use in near real time will keep certifying yesterday's org chart rather than today's operational risk. Security leaders should judge governance by how quickly it can see and constrain privilege drift.
Entitlement-aware integration is the named control concept this market is converging on. The article's core message is that coverage metrics are too shallow unless they reach the permission layer inside non-native systems and machine identities. That is the control plane enterprise identity now needs: one that can govern permissions, not just connections. Practitioners should measure whether their platform can actually enforce least privilege across heterogeneous systems, not merely connect to them.
Separation of duties becomes unreliable when governance is detached from the systems where decisions are made. If the entitlement layer is opaque, SoD checks become retrospective reports rather than active controls. That weakens auditability, complicates incident response, and leaves privilege creep to accumulate quietly. The practical conclusion is straightforward: SoD should be evaluated as a live entitlement control across every governed system, not as a directory report.
What this signals
Entitlement-aware governance is becoming the separating line between usable identity platforms and incomplete control models. Organisations that can only see sign-in events will keep missing the permission layer where least privilege and SoD actually fail. The programme implication is to evaluate governance depth system by system, not by connector count.
Non-human identity governance now belongs inside the main identity programme, not beside it. Service accounts, API keys, and AI agents are no longer edge cases. When they outnumber human users, lifecycle and review processes have to be built for machine identities as a default operating model, not as an exception.
Governance velocity matters because privilege drift happens between review cycles. Static certification can still be useful, but it cannot be the only control when access usage changes faster than the review cadence. Teams should shift from periodic reassurance to continuous visibility into entitlement change.
For practitioners
- Establish entitlement-level governance coverage Map which applications expose roles, privileges, and toxic access relationships beyond the directory, then prioritise those systems for deeper governance integration.
- Separate SSO coverage from governance coverage Audit your integration inventory and label each connection by what it actually supports: authentication only, or authentication plus entitlement visibility and review.
- Inventory all non-human identities Build an authoritative register for service accounts, API keys, tokens, and AI agents, including owners, purpose, and review cadence.
- Shorten the distance between usage and review Use actual entitlement usage and peer-group behaviour to drive certification decisions instead of relying only on static org charts or annual access review cycles.
- Validate separation of duties at the permission layer Test SoD conflicts in the systems where transactions happen, not just in the directory, so that application-level conflicts are visible before certification.
Key takeaways
- Directory coverage alone does not equal governance, because permissions inside non-native applications can remain invisible even when sign-in is controlled.
- The article points to 71% of organizations suffering at least one identity-related breach in the past year, which underscores how common identity control drift has become.
- Security teams need governance that reaches the entitlement layer, covers non-human identities, and reduces the lag between access change and review.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 and MITRE ATT&CK address the attack and risk surface, while NIST CSF 2.0 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-05 — Overprivileged NHI | The article centres on ungoverned permissions and privilege drift across non-human identities. |
| NHI-01 — Improper Offboarding | Lifecycle gaps for service accounts and AI agents create persistent access outside governance review. | |
| Recommendation — Audit machine and service identities for excess permissions and remove standing privilege where it is not justified. Track offboarding for non-human identities and revoke access when the owning system, team, or purpose changes. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | The article’s core problem is entitlement visibility and control across heterogeneous applications. |
| Recommendation — Apply entitlement controls to verify and constrain permissions in every governed application, not just the directory. | ||
| CIS Controls v8 | CIS-5 — Account Management | The blog addresses account and entitlement governance across human and machine identities. |
| Recommendation — Maintain authoritative account records and remove stale access paths across all identity types. | ||
| MITRE ATT&CK | TA0004;TA0006;TA0008 — Privilege Escalation; Credential Access; Lateral Movement | Overprivileged identities and weak entitlement control align with common adversary paths. |
| Recommendation — Map entitlement blind spots to privilege escalation, credential access, and lateral movement scenarios in your detection model. | ||
Key terms
- Entitlement Controls: Entitlement controls restrict what data a user or system can access based on assigned permissions. In AI pipelines, they preserve access boundaries so models only work with data the requester is allowed to see. This helps prevent overexposure, strengthens least privilege, and makes governance enforceable.
- Governance Velocity: Governance velocity is the speed at which an identity programme can detect, review, and correct access changes before risk accumulates. It measures whether governance keeps pace with operational change, especially in hybrid estates where privileges drift between review cycles and static certifications become stale.
- Non-Native Application: A non-native application is a system whose access and entitlement model is not managed by the organisation’s primary directory or platform-native tools. These systems often hide effective permissions behind local roles, delegated admin, or application-specific controls that require separate governance visibility.
- Segregation of Duties: Segregation of Duties is a control principle that prevents one person or role from combining incompatible permissions that could create fraud, error, or undetected change. In ERP environments, it must account for roles, transactions, approvals, and compensating controls across business processes.
Deepen your knowledge
NHI governance, agentic AI identity, and machine identity security are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.
Published by the NHIMG editorial team on September 14, 2026.
Updated on October 6, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org