Identity governance gaps widen as cloud and AI access sprawl

At a glance

What this is: NHI Mgmt Group's analysis, drawing on Opti's blog post: Identity governance has to extend across human, machine, and agentic access as cloud sprawl and continuous change outpace traditional review cycles.

Why it matters: This matters because IAM and IGA teams need governance models that can keep pace with service accounts, AI agents, and fast-changing entitlements without losing auditability or least privilege.

Context

Identity governance is the layer that turns access management into a governed process rather than a one-time grant. It matters because modern environments now mix employee accounts, service accounts, API keys, bots, and AI-driven access paths, each of which ages, changes, and drifts in a different way.

The problem is not that organisations lack policies. It is that identity data, approval flow, and entitlement state often fall out of sync across cloud and SaaS systems, leaving certification and deprovisioning to operate on stale information. NHI lifecycle management becomes critical when access changes faster than manual review cycles can keep up.

For many programmes, the baseline assumption that access can be reviewed after it is granted is already under strain. When identities are created dynamically and permissions are inherited across platforms, governance has to stay continuous rather than periodic.

Key questions

Q: How should teams handle access reviews in fast-changing SaaS environments?

A: Teams should move from periodic, app-by-app certification to centralized review of the full entitlement graph. That means collecting access from SaaS, cloud, identity and HR sources, then prioritizing privileged and business-critical systems first. The goal is to certify effective access, not just listed roles, and to connect review decisions directly to remediation.

Q: Why do closed-loop provisioning controls matter in identity governance?

A: Closed-loop provisioning matters because access changes are only trusted when the identity system can verify that each entitlement was actually created, modified or removed as intended. The control links request, approval, provisioning and reconciliation, so a joiner-mover-leaver event or role change cannot leave orphaned access, duplicate accounts or stale entitlements in IAM or PAM.

Q: What problem does ownership attribution solve for service accounts and API keys?

A: It closes the gap between exposure detection and accountable remediation. Many organisations can find the secret, but not the human who introduced it, maintains it, or can safely replace it. Ownership attribution gives security teams a practical way to assign action without relying on informal knowledge that disappears during staff changes.

Q: What is the best way to extend segregation of duties to bots and agents?

A: The best way is to apply the same conflict logic used for humans, then map each bot or agent to an accountable owner and a bounded set of tasks, tools and data. Segregation of duties should block incompatible actions, such as creating and approving the same transaction, and enforcement should use policy checks at runtime plus revocation when the agent exceeds scope.

Technical breakdown

Access certifications fail when entitlements move faster than review cycles

Access certification, or attestation, is a periodic control that asks reviewers to confirm whether existing permissions still make sense. It works best when identity state is relatively stable and the system of record is accurate. In cloud and SaaS environments, however, entitlements can change between review intervals, and role drift, direct grants, or stale sync data can make the review output incomplete. The result is a control that proves a past snapshot, not current reality. See the IAM and IGA Basics.

Practical implication: Treat certification as an evidence process, not a source of truth, and pair it with current entitlement visibility before reviewers sign off.

Closed-loop provisioning is the control that prevents silent access drift

Closed-loop provisioning and deprovisioning adds feedback to the identity lifecycle. Instead of assuming a request was successfully applied everywhere, the governance system verifies that downstream accounts, groups, and permissions were actually created or removed. That matters because distributed systems often fail partially. Without verification, organisations can end up with orphaned access, incomplete removals, or inconsistent entitlement states across applications, directories, and cloud services.

Practical implication: Use verified provisioning outcomes as the governance record of truth, especially for offboarding and role-change workflows.

Non-human identity governance requires ownership, inventory, and rotation discipline

Non-human identities include service accounts, API keys, tokens, certificates, workloads, bots, and AI agents that act on behalf of systems or processes. These identities often outnumber human users and may carry broad or persistent access because they were created for automation rather than review. Governance fails when ownership is unclear, credentials are long-lived, or lifecycle events are never tied back to the identity. That is why inventory and lifecycle control are central, not optional. Read Top 10 NHI Issues.

Practical implication: Map every non-human identity to an owner and lifecycle state before you rely on it for production access.

Breaches seen in the wild

• BeyondTrust breach 2024: A stolen BeyondTrust Remote Support API key let a China state-sponsored actor reset accounts and reach US Treasury workstations in 2024.
• Coupang Signing Key Breach: Unrevoked signing key credentials expose 33.7 million records after employee offboarding failure at Coupang.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Identity governance is no longer just an entitlement review discipline. It has become a control layer for continuous change across human and non-human access. The more cloud services, delegated permissions, and automated workflows an organisation uses, the less useful a static review model becomes. That shift forces IGA teams to think in terms of current state assurance, not periodic documentation.

Continuous identity drift is the named governance failure this article exposes. Access state changes faster than certification cadences, so governance decisions are often made against stale data. That breaks the assumption that a review cycle can reliably catch excess access after the fact, which is why closed-loop verification matters as much as policy definition. Practitioners should treat drift detection as a first-class governance requirement.

Non-human identity coverage is now a core governance metric, not a niche add-on. Service accounts, API keys, and AI-driven access paths create the same accountability problem as human users, but they move at machine speed and can be far more numerous. When ownership, inventory, and offboarding do not cover these identities, the programme has blind spots that auditors and attackers will both find. Teams should extend governance metrics beyond staff accounts.

Access governance is converging with operational identity security. The old split between “governance” and “runtime enforcement” is getting harder to sustain because modern access decisions depend on live entitlement state, current usage, and downstream verification. That means identity teams need shared visibility across IGA, IAM, and NHI controls rather than isolated process ownership. Practitioners should align these functions around one authoritative access record.

Segregation of duties remains relevant, but it now has to scale across mixed identity types. SoD is no longer only a human finance control. The same conflict logic increasingly applies to service accounts, bots, and agentic workflows that can trigger conflicting actions if left unchecked. The governance question is not whether SoD still matters, but whether it is enforced consistently across all actors. Teams should extend conflict analysis beyond employee roles.

From our research library:

• Only 5.7% of organisations have full visibility into their service accounts, according to the Ultimate Guide to NHIs.
• Read next: NHI Lifecycle Management Guide

What this signals

Continuous identity drift: governance programmes now need to assume that access state can change between review cycles, not just after a leaver event or role transfer. That pushes the operating model toward live entitlement visibility and verified deprovisioning rather than periodic paperwork.

Service accounts and similar non-human identities remain the weakest part of many governance programmes because they are often excluded from the same inventory, ownership, and certification discipline applied to people. Once those identities are in scope, the control model becomes materially more accurate.

The practical shift is from review-centric governance to state-centric governance, where the authoritative question is whether the current access picture is provable right now. That is the only model that scales across cloud, SaaS, and automation-heavy environments.

For practitioners

• Map every identity class to a control owner Build a single inventory that separates human users, service accounts, API keys, workloads, and agentic identities, then assign a named owner and review cadence to each record.
• Verify offboarding across downstream systems Do not treat a deprovisioning request as complete until connected applications confirm the account, token, or entitlement was actually removed.
• Align access reviews to live entitlement data Feed certification campaigns with current account, role, and permission state so reviewers are not validating obsolete access snapshots.
• Extend SoD checks to non-human workflows Apply conflict rules to bot, service account, and agent permissions wherever one identity can initiate incompatible actions in the same business process.

Key takeaways

• Identity governance breaks down fastest when access state changes more quickly than certification and deprovisioning cycles can track.
• The clearest evidence of the gap is weak visibility into service accounts and other non-human identities that fall outside human-centric review models.
• A stronger programme ties inventory, ownership, live entitlement checks, and verified offboarding into one governed access record.

Related NHI Mgmt Group resources: NHI Lifecycle Management Guide · Top 10 NHI Issues · Segregation of Duties (SoD) Guide

Key terms

• Identity Governance: Identity governance is the set of controls that defines who approves access, who owns it, how it is reviewed, and when it is removed. In practice, it turns identity management from a deployment task into a durable control system that can withstand audits, organisational change, and operational growth.
• Access Certification: Access certification is the periodic review of whether an identity still needs its current entitlements. For NHIs, certification is only reliable when reviewers know the identity's owner, purpose, and expiry, otherwise stale machine access can persist long after the original use case has ended.
• Closed-Loop De-Provisioning: Closed-loop de-provisioning means a review decision automatically changes the underlying access state. When a reviewer rejects or revokes access, the entitlement is removed in the source system, not left for manual cleanup. This closes the gap between compliance evidence and actual control enforcement.
• Separation Of Duties: Separation of Duties is a control that splits critical tasks across different people or systems so no single identity can complete an entire sensitive process alone. In IAM and NHI governance, it reduces fraud, error, and abuse by separating provisioning, approval, execution, and review privileges across distinct roles or accounts.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.