Identity governance in the AI era: why IGA still fails

At a glance

What this is: This is an analysis of why traditional identity governance and administration breaks down as access sprawl, dormant permissions and non-human identities scale across modern environments.

Why it matters: It matters because IAM teams, IGA leads and PAM teams need governance that can keep pace with human, workload and AI-driven access changes instead of relying on periodic approval cycles alone.

Context

Identity governance and administration is the discipline that keeps access aligned to role, usage and policy after the initial grant. In this article, the governance gap is not whether access can be approved, but whether it can be continuously justified as identities, permissions and environments change.

The source argues that legacy IGA creates an adoption penalty through high implementation effort, fragmented data and review fatigue. That matters for NHI, human IAM and emerging AI agent governance because the same lifecycle problem now spans people, service accounts, APIs and automated workloads.

Key questions

Q: What breaks when access reviews lack reviewer context?

A: Reviewers cannot distinguish legitimate access from unnecessary access if they only see a name and a checkbox. Without usage, role, ownership, and application context, certification becomes a formality, and risky access survives because the decision-maker has too little evidence to act confidently.

Q: Why do organisations still end up with privilege creep even with IGA in place?

A: Privilege creep persists when access grants are easy but revocation is slow, manual or poorly tied to mover and leaver events. The result is that old permissions survive role changes, project exits and contractor offboarding. Governance fails when the lifecycle is managed as a one-time event instead of a continuous process.

Q: How should security teams govern non-human identities alongside human accounts?

A: Security teams should govern non-human identities as a separate lifecycle category with their own inventory, ownership, rotation, and offboarding controls. Human IAM processes are useful, but they do not account for machine-to-machine authentication, code-embedded secrets, or always-on service accounts. The key is to map each identity to a business function and enforce expiry, review, and revocation on that basis.

Q: Should organisations rely on IAM alone for identity governance?

A: No. IAM decides whether access is granted at the front door, but it does not keep proving that access still makes sense after the fact. Governance needs a separate control layer for certifications, entitlement management and lifecycle checks, otherwise access drift goes undetected.

Technical breakdown

Why access certifications degrade under review fatigue

Access certifications are meant to verify that permissions are still needed, but the control weakens when reviewers face long entitlement lists without usage context. When managers cannot see recent activity, peer comparison or role changes, they tend to approve by default. That turns certification into compliance theatre rather than access governance. In mixed environments, the problem compounds because human access, service accounts and application privileges all move on different cadences. The result is that stale access persists even while the review looks complete. Mature governance therefore depends on decision quality, not just review completion.

Practical implication: improve review context before increasing review frequency, or certifications will keep rubber-stamping excess access.

How privilege creep and orphaned accounts accumulate across the identity lifecycle

Privilege creep occurs when users retain access from prior roles, temporary tasks or old projects after their current job changes. Orphaned accounts arise when departed employees, contractors or test identities remain active because offboarding and deprovisioning are incomplete. In a cloud-heavy estate, the same pattern applies to service accounts and other non-human identities, which are often created faster than they are governed. The technical issue is lifecycle drift: identity creation is easy, but access reduction is manual, delayed or inconsistent. That is why continuous lifecycle control matters more than one-time provisioning.

Practical implication: tie access removal to role change and offboarding events, especially for accounts that do not have a human owner watching them.

Why modern governance has to combine IGA, IAM and PAM

IAM, IGA and PAM solve different parts of the access problem. IAM controls the entry decision, IGA checks whether access remains appropriate over time, and PAM protects elevated credentials that can affect critical systems. The article’s core point is that treating these as interchangeable leaves blind spots, especially where privileged or service access spans cloud, SaaS and on-premises systems. The governance model has to connect initial authentication, ongoing certification and high-risk privilege isolation. Without that division of labour, organisations either over-control routine access or under-govern the most dangerous access paths.

Practical implication: map each access type to the right control layer instead of forcing IAM to carry governance and PAM to carry lifecycle.

NHI Mgmt Group analysis

Access governance fails when review cadence is treated as proof of control. Periodic certification only works when the reviewer has enough context to make an informed decision. In modern estates, that context is fragmented across SaaS, cloud, on-premises systems and NHI inventories, so the governance signal degrades quickly. The practitioner implication is that governance must move from checkbox review completion to contextual decision quality.

Legacy IGA creates an adoption barrier that becomes a governance risk in itself. When implementation takes 18 months or longer, organisations delay coverage, simplify scope, or accept partial control through IGA Light. That leaves the most dynamic identities outside meaningful oversight. The implication is that governance architecture has to be deployable at the speed of identity change, not the speed of a traditional programme.

Identity governance in the AI era is really lifecycle governance across three actor types. The same joiner-mover-leaver problem now spans humans, service accounts and AI-enabled automation. The operational difference is not the policy goal but the execution tempo, which is much faster for non-human identities. Practitioners need a governance model that tracks who or what owns the access, how it is used, and when it should be removed.

Access sprawl is the symptom, but entitlement drift is the underlying failure mode. Permissions accumulate because organisations treat provisioning as the primary event and offboarding as an exception. Once that assumption takes hold, unused access becomes normal, not anomalous. The practitioner implication is to treat every standing entitlement as a time-bound exception unless it is continuously re-justified.

Continuous proof of appropriateness is becoming the defining control requirement. The article shows that modern identity governance is no longer just about approvals at grant time. It is about proving that access still matches role, usage and risk after the fact, across changing business and technical conditions. Teams should judge identity programmes by how quickly they detect drift, not by how many requests they approve.

From our research library:

• Nearly 60% of IT leaders cite restrictive cost and complexity as a weakness of legacy identity governance, according to the 2025 State of Identity Governance Report.

What this signals

Access governance has become a lifecycle problem, not an approval problem. The practical shift for security teams is to treat every entitlement as something that can drift, not something that stays valid until someone remembers to review it. That means joiner-mover-leaver events, certification quality and owner accountability matter more than the existence of a review campaign.

Non-human identities pull governance beyond the human rhythm. Service accounts and other machine credentials do not age on a manager's schedule, so access controls that depend on periodic human review will always lag the identity estate. Teams should design governance around ownership, usage and revocation triggers that work for both people and machines.

Identity programmes now need continuous evidence, not annual reassurance. When permissions are fragmented across cloud, SaaS and on-premises systems, the main programme signal is whether the organisation can explain why a given access path still exists today. That question should drive remediation priorities, reporting and control design.

For practitioners

• Map access by lifecycle stage Classify identities by joiner, mover and leaver state, then separate human, service account and application access paths so governance events do not share one generic workflow.
• Add usage context to certifications Feed recent usage, peer comparison and role change data into review campaigns so approvers see whether access is still needed before they sign off.
• Inventory non-human identities alongside users Track service accounts, API keys and other non-human identities in the same governance model as employees and contractors so orphaned access does not sit outside review cycles.
• Separate baseline access from privileged access Use IAM for entry control, IGA for ongoing appropriateness and PAM for elevated credentials so each control layer owns the part of the problem it can actually govern.
• Measure dormant access exposure Review permissions that have not been used recently and remove or re-authorise them before they become standing exceptions in cloud and SaaS environments.

Key takeaways

• Legacy IGA fails most visibly when organisations confuse access approval with ongoing access governance.
• The risk is not just unused permission sprawl, but stale rights that survive role changes, contractor exits and machine identity growth.
• Teams need lifecycle-aware governance, contextual reviews and clearer ownership if they want access decisions to stay defensible.

Key terms

• Identity Governance and Administration (IGA): A framework of policies, processes, and technology to manage and govern digital identities and their access rights. Increasingly extended to cover non-human identities alongside human users.
• Access Certification: Access certification is the periodic review of whether an identity still needs its current entitlements. For NHIs, certification is only reliable when reviewers know the identity's owner, purpose, and expiry, otherwise stale machine access can persist long after the original use case has ended.
• Privilege Creep: Privilege creep is the gradual accumulation of access rights beyond what an identity actually needs. It usually happens when permissions are added for convenience and never removed. For NHIs, privilege creep expands blast radius and makes old credentials far more dangerous than their original purpose suggests.
• Orphaned Account: An orphaned account is an identity that remains active without a clear owner or business purpose. These accounts are dangerous because they often escape review, retain unnecessary access, and provide attackers with low-friction entry points into otherwise governed environments.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity security are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.