Identity governance for cloud-native teams still lags access change

At a glance

What this is: This is an analysis of identity governance and administration tools, with the central finding that legacy, review-driven models lag cloud-native access change and leave privilege sprawl behind.

Why it matters: It matters because IAM and NHI teams now have to govern service accounts, tokens, and human access with the same control discipline, not periodic cleanup.

By the numbers:

• Third-party involvement in breaches doubled to 30% over the last year.

👉 Read Apono's guide to the top 10 identity governance and administration solutions

Context

Identity governance and administration is the discipline of deciding who has access to what, why that access exists, and whether it should still exist. In cloud-native environments, that question now extends to non-human identities as well, because service accounts, tokens, and automated workflows often hold the permissions that matter most.

The problem is not that governance has become less important. The problem is that many IGA programs still rely on periodic review cycles while permissions now change continuously across infrastructure, data platforms, and SaaS tools. That makes traditional attestation necessary but insufficient for NHI governance, especially when third-party access is part of the blast radius.

The article’s starting position is typical of what practitioners are seeing in modern cloud estates: static governance models struggle once engineering teams ship daily and access decisions become distributed.

Key questions

Q: How should security teams govern just-in-time access for non-human identities?

A: Treat JIT access as a lifecycle control, not a convenience feature. Require task-scoped approval, automatic expiration, and revocation logging for every grant. Apply the same policy to service accounts and automation as you would to privileged humans, because NHIs can retain risk long after the work is finished.

Q: When does identity governance become an operational risk instead of a control?

A: Identity governance becomes a risk when it only describes access instead of enforcing it. If reviews happen after permissions have already spread, the organisation is documenting exposure rather than reducing it. That is especially true in cloud-native environments where entitlement drift can happen between review cycles.

Q: What is the difference between access review and continuous entitlement enforcement?

A: Access review is retrospective. It tells you whether access looked appropriate at a point in time. Continuous entitlement enforcement is preventive. It constrains duration, scope, and revocation so access cannot quietly persist beyond its intended task, which is the more useful model for NHIs and fast-moving cloud teams.

Q: How can teams reduce standing privilege without slowing developers down?

A: Use self-service request flows with policy-based approvals, then make privilege expire automatically when the approved window ends. That preserves developer velocity while removing the main failure mode of legacy IGA, which is permanent access granted for temporary work.

Technical breakdown

Why periodic access reviews fail in cloud-native IGA

Periodic reviews assume access changes slowly enough for quarterly attestation to catch drift. That model breaks when engineers, services, and vendors request elevated access throughout the week, because privilege can become permanent between review cycles. In practice, the failure is architectural: governance is treated as a report after the fact instead of a control that operates at the moment access is granted. For NHI programs, that gap matters because service accounts and automation do not wait for the next review window to accumulate risk.

Practical implication: Replace review-only governance with controls that can revoke or expire access as soon as the task ends.

How time-bound access changes the privilege model

Just-in-time access and time-bound permissions reduce the duration of exposure by issuing access only for the approved task window. The key mechanism is not merely approval, but enforced expiration and automatic revocation, which keeps temporary privilege from turning into standing privilege. That is especially important for cloud infrastructure, where broad entitlements can spread through APIs, CI/CD workflows, and third-party integrations. In NHI terms, the access model must assume that machine and human actors can both accumulate unnecessary permissions unless the control plane actively constrains duration.

Practical implication: Scope every elevated entitlement to a job, a duration, and a clear revocation path.

Why audit evidence now depends on enforcement, not spreadsheets

Audit-ready governance is no longer just about producing a list of entitlements. Auditors increasingly want evidence that least privilege was actually enforced, including who approved access, when it expired, and whether access matched the role or workload that needed it. Static exports can show intent, but they do not prove control effectiveness if access remained active after the need passed. For NHI governance, the same issue applies to service accounts and tokens: if the control system cannot prove lifecycle discipline, the evidence is weak even when the spreadsheet looks clean.

Practical implication: Capture access start, expiration, and approval metadata as part of the control, not as a separate reporting exercise.

Threat narrative

Attacker objective: The objective is to convert unmanaged access sprawl into durable privilege that can be used for lateral movement, data access, or operational disruption.

1. Entry occurs when third-party access or over-broad credentials remain active long after they should have been revoked.
2. Escalation follows when temporary permissions are not time-bounded, letting an attacker or compromised workflow inherit broader access than intended.
3. Impact emerges when distributed access decisions create a large blast radius across applications, infrastructure, and sensitive data.

Breaches seen in the wild

• Salesloft OAuth token breach — hackers stole OAuth tokens to access Salesforce data via Salesloft.
• Internet Archive breach — unsecured GitLab authentication tokens exposed 31M Internet Archive accounts.

Read our 52 NHI Breaches Analysis report for a comprehensive view of breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Static IGA is no longer an acceptable control model for cloud-native estates. Quarterly review and role cleanup do not match environments where access changes daily and non-human identities operate continuously. The discipline now has to move from evidence collection to enforced access duration, or governance will always trail the blast radius.

Identity governance for NHIs must be lifecycle-native, not just workflow-native. Provisioning, expiration, revocation, and review need to be treated as one control chain rather than separate administrative tasks. That is the only way to govern service accounts, tokens, and automation without leaving stale privilege behind.

Third-party access is a governance problem, not just a vendor-management problem. When external systems, contractors, and integrations participate in the access graph, the permission boundary becomes harder to see and easier to abuse. Practitioners should assume that every extra integration increases the number of places where privilege can outlive its purpose.

Time-bound access is becoming the default language of least privilege. The field is moving away from static entitlements because modern engineering teams need access that matches the task, not the org chart. That shift does not remove governance overhead, but it changes where the control point sits, and practitioners should align identity policy to actual operational tempo.

Access evidence must prove control effectiveness, not just administrative intent. If access reviews are not paired with automatic expiry and revocation logs, audit artifacts can overstate the real security posture. NHI programs should treat evidence as an outcome of the control plane, not a separate compliance chore.

From our research:

• 70% of organisations grant AI systems more access than they would give a human employee performing the exact same job, according to the 2026 Infrastructure Identity Survey.
• Only 44% of organisations have implemented any policies to manage their AI agents, even though 92% agree that governing AI agents is critical to enterprise security.
• For the broader control model, see Ultimate Guide to NHIs , Lifecycle Processes for Managing NHIs for provisioning, rotation, and offboarding patterns that map directly to access governance.

What this signals

The programme-level signal is clear: cloud-native identity governance is converging with NHI governance because the access graph now includes service accounts, automations, and external integrations. Teams that keep separate workflows for humans and machines will miss the real accumulation point, which is standing privilege across distributed systems.

Identity blast radius: the practical risk is no longer only who can log in, but how far a granted entitlement can travel before it is reviewed or revoked. That is why the shift to time-bound access should be treated as a control design decision, not an implementation detail. For teams formalising this work, the NIST Cybersecurity Framework 2.0 remains useful for mapping governance to the govern and protect functions.

For practitioners

• Move from quarterly review to continuous entitlement control Reclassify high-risk human and NHI permissions so they are subject to automatic expiration, continuous monitoring, and task-scoped approval rather than periodic attestation alone.
• Inventory service accounts and third-party entitlements together Build one inventory that covers human users, service accounts, API keys, tokens, and vendor connections so hidden privilege pathways are visible in the same governance workflow.
• Require revocation evidence for every elevated access grant Store approval time, expiration time, and revocation event data together so audit teams can verify that privileged access did not outlive the approved task window.
• Align least privilege to the actual execution context Use resource, environment, and time constraints to narrow access for cloud operations, CI/CD, and production support instead of relying on broad role templates that stay open too long.

Key takeaways

• Legacy IGA still helps with lifecycle administration, but it is too slow to contain privilege drift in cloud-native and NHI-heavy environments.
• The measurable risk is not theoretical access sprawl alone, but the way distributed permissions widen the blast radius when third parties and automation are involved.
• Practitioners should move toward continuous, time-bound enforcement so governance evidence and actual control effectiveness line up.

Key terms

• Identity Governance and Administration: Identity governance and administration is the discipline of defining, approving, and proving who can access systems and data. In modern estates it includes lifecycle tasks, policy enforcement, and evidence generation for both human users and non-human identities across cloud and on-prem environments.
• Standing Privilege: Standing privilege is access that remains active after the immediate need has passed. It usually appears when temporary work is granted with permanent entitlements, creating unnecessary exposure for users, service accounts, and automation that continue to hold permissions without a current business need.
• Time-Bound Access: Time-bound access is a control pattern that grants permissions for a defined window and removes them automatically when the window ends. It is a practical least-privilege mechanism for cloud operations and NHI governance because it reduces how long elevated access can be abused.
• Entitlement Drift: Entitlement drift is the slow accumulation of permissions that no longer match the original purpose, role, or workload. In cloud-native and NHI-heavy environments, it usually happens because access changes faster than review cycles, leaving organizations with more privilege than they intended.

Deepen your knowledge

Identity governance and administration for non-human identities is covered in our NHI Foundation Level course, the industry's only accredited NHI security programme. If your team is trying to govern cloud-native access without slowing delivery, it is worth exploring.

This post draws on content published by Apono: Top 10 Identity Governance and Administration Solutions. Read the original.