Identity governance for cloud-native teams still lags access change

At a glance

What this is: This is an analysis of why identity governance and administration struggles to keep pace with cloud-native permission change, especially when temporary access becomes permanent.

Why it matters: It matters because IAM, IGA, PAM, and NHI programmes now need continuous enforcement and evidence, not periodic review cycles, to control privilege drift across fast-moving cloud teams.

By the numbers:

• Third-party involvement in breaches doubled to 30% over the last year, which the article links to scattered access decisions across vendors, apps, and infrastructure.

Context

Identity governance and administration is the discipline that answers who has access to what, when, and why. In cloud-native environments, that answer changes quickly because permissions are created, expanded, and forgotten faster than periodic review cycles can track.

The governance gap is not that access policies do not exist. The problem is that static roles, delayed certifications, and manual approvals leave standing privilege in place after the business need has passed, which is especially risky when third-party access and non-human identities are part of the estate.

Apono's article frames the issue as a mismatch between legacy governance design and modern delivery speed. That is a typical cloud-native problem, not an edge case, because the operating model itself keeps moving while the control model stays still.

Key questions

Q: What breaks when identity governance depends on quarterly cycles?

A: Quarterly cycles break the assumption that access state stays stable long enough to review it later. In practice, permissions drift, secrets leak, and service accounts accumulate unnecessary privilege between review points. By the time the cycle ends, the risk may already have changed shape and become harder to reverse.

Q: Why do third-party access paths increase identity risk across enterprise programmes?

A: Third-party access paths increase identity risk because they often rely on tokens, OAuth grants, API keys, and service accounts that sit outside the normal employee lifecycle. Those identities can remain valid long after the business context has changed. IAM and PAM teams need to govern the access path itself, not just the supplier relationship.

Q: How do security teams know if just-in-time access is actually working?

A: Look for short-lived sessions, automatic revocation, and complete request-to-access logs. If approvals are still creating durable permissions, or if teardown depends on manual cleanup, then the programme is only partially ephemeral. Effective JIT should leave little or no reusable privilege behind after the task ends.

Q: Should organisations prioritise just-in-time access over broad access reviews?

A: Yes, when the objective is to reduce active exposure rather than just document it. Access reviews tell you what exists, but just-in-time access changes how long privilege exists in the first place. For high-risk permissions, reducing standing access usually delivers faster risk reduction than another review cycle.

Technical breakdown

Why static roles fail in cloud-native IGA

Static roles assume access can be grouped, assigned, and reviewed on a slow cadence. In cloud-native teams, entitlements change around deployments, incidents, temporary collaborations, and third-party tooling, so the role model quickly becomes a lagging approximation of reality. That creates entitlement drift, where access remains broader than intended long after the original task is complete. When IGA is built around snapshots instead of runtime change, the governance record becomes stale before the next review begins.

Practical implication: treat role design as a control surface that must be revalidated against live cloud permissions, not a one-time governance artifact.

How time-bound access changes the governance model

Just-in-time access and automatic expiry move the control point from after-the-fact review to access issuance. Instead of certifying what is already standing, governance constrains how long a permission can exist and ties it to a specific operational need. That matters in DevOps and cloud operations because many access events are temporary by design, whether for troubleshooting, production support, or a vendor task. Continuous enforcement replaces the assumption that access will still be present when a reviewer gets around to it.

Practical implication: use time limits and revocation automation for privileges that are operationally temporary, especially in production and third-party workflows.

Why audit evidence depends on real-time access control

Audit-ready IGA is not just a reporting function. Auditors want proof that least privilege exists in practice, not only on paper, which means the evidence must reflect actual access state, approval context, and duration. In cloud-native estates, access can span infrastructure, SaaS apps, data stores, and service accounts, so fragmented logs produce weak assurance. A defensible record needs to show who had access, for how long, why it was granted, and whether it expired as intended.

Practical implication: design audit trails to capture access duration and revocation events, not only request approvals and periodic attestations.

Threat narrative

Attacker objective: The objective is to turn scattered, over-retained access into a broader breach path that can be reused across cloud and third-party environments.

1. Entry occurs when access decisions are spread across vendors, apps, and infrastructure, creating enough confusion for excess privileges to accumulate unnoticed.
2. Privilege escalation follows when temporary access becomes permanent and standing permissions remain in place after the original need has ended.
3. Impact appears as a larger blast radius, because compromised or misused access can move farther across cloud systems, third-party tooling, and data services than intended.

Breaches seen in the wild

• Salesloft OAuth token breach: hackers stole OAuth tokens to access Salesforce data via Salesloft.
• Klue OAuth Supply Chain Breach: OAuth tokens compromised in Klue integration breach affecting 700+ organisations via Salesforce data access chain.

Read our 52 NHI Breaches Analysis report for a comprehensive view of breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Cloud-native IGA fails when governance is still treated as a snapshot problem. Static roles and quarterly certifications were designed for slower permission change. They break down when cloud teams create, modify, and retire access continuously across infrastructure, SaaS, and data systems. The practitioner conclusion is simple: governance must follow the rate of change, not the calendar.

Third-party access is now a first-order governance issue, not an edge case. The article's 30% breach figure shows that external involvement is no longer a side channel. When vendors, apps, and infrastructure are all in the access graph, weak lifecycle control turns outside relationships into inside exposure. Practitioners need to govern third-party access with the same rigor they apply to employee entitlements.

Time-bound access is the operational shape of least privilege in fast-moving cloud estates. Least privilege only works if privilege can expire when the task ends. That is why JIT and automatic revocation are not conveniences but structural controls for cloud-native teams. The implication for identity programmes is that governance must become temporal, not just role-based.

Audit evidence is only trustworthy when it reflects live entitlement state. Certifications that lag behind actual permissions produce compliance theatre rather than control assurance. Modern governance has to capture access duration, revocation, and context in a way that stands up to SOC 2, GDPR, and similar expectations. Practitioners should treat evidence quality as a control outcome, not a reporting afterthought.

Permissions drift is the named failure mode hiding inside many cloud governance programmes. The article shows how temporary access quietly becomes permanent, which means the real problem is not lack of policy but lack of lifecycle enforcement. The practitioner conclusion is that access governance must be continuous if the environment changes continuously.

From our research library:

• 92% of organisations expose NHIs to third parties, raising concerns about supply chain security, according to the Ultimate Guide to NHIs.
• Read next: Top 10 NHI Issues

What this signals

Permissions drift is the core governance signal in cloud-native teams. The more frequently access changes, the less useful periodic certification becomes as the primary control. Programmes should shift their centre of gravity toward automatic expiry, live entitlement visibility, and revocation that happens when the work ends, not when the review arrives.

Third-party exposure turns identity governance into a supply chain control problem. According to the Ultimate Guide to NHIs, 92% of organisations expose NHIs to third parties, which means external access governance is now part of the attack surface, not just the vendor-management checklist.

For practitioners

• Implement time-bound access for temporary work Apply expiry to access granted for incidents, vendor tasks, and short-lived operational work so permissions do not remain after the task ends.
• Separate third-party access from standing internal roles Track vendor, contractor, and partner access as distinct governed lifecycles so external permissions can be reviewed and removed without affecting employee access.
• Automate deprovisioning on role change and task completion Use workflow triggers to revoke access immediately when an assignment ends, not during the next review cycle, especially for cloud, data, and CI/CD entitlements.
• Build audit logs around access duration and reason Record who approved access, what scope was granted, how long it lasted, and whether revocation occurred as intended so audit evidence is defensible.

Key takeaways

• Cloud-native identity governance breaks down when access changes faster than static roles and periodic reviews can track.
• Third-party involvement and standing privilege expand the blast radius when permissions are scattered across vendors, apps, and infrastructure.
• Time-bound access, automatic revocation, and defensible audit evidence are the practical controls that align governance with modern delivery speed.

Key terms

• Identity Governance and Administration (IGA): A framework of policies, processes, and technology to manage and govern digital identities and their access rights. Increasingly extended to cover non-human identities alongside human users.
• Time-Bound Access: Time-bound access is a control pattern that grants permissions for a defined window and removes them automatically when the window ends. It is a practical least-privilege mechanism for cloud operations and NHI governance because it reduces how long elevated access can be abused.
• Standing Privilege: Standing privilege is access that remains active even when no immediate task requires it. For NHI programmes, it is a common failure mode because long-lived credentials and persistent roles create unnecessary exposure. Reducing standing privilege usually means tighter expiry, on-demand access, and clearer review of who or what still needs access.
• Entitlement Drift: Entitlement drift is the slow accumulation of permissions that no longer match the original purpose, role, or workload. In cloud-native and NHI-heavy environments, it usually happens because access changes faster than review cycles, leaving organizations with more privilege than they intended.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.