Identity governance is breaking under scale and lifecycle sprawl

At a glance

What this is: This is 1Kosmos’s analysis of why identity governance weakens as organisations scale, with lifecycle management, RBAC, and access reviews under increasing strain from sprawl and compliance demands.

Why it matters: It matters because IAM and IGA teams need governance that keeps pace with role changes, offboarding, and audit pressure across human and non-human identity estates.

Context

Identity governance is the discipline of making sure access stays aligned with business role, policy, and risk over time. The problem in this article is not the concept itself, but the gap that opens when organisations grow faster than their governance processes can follow, especially across access reviews, role design, and offboarding.

For IAM and IGA teams, scale is what turns a governance framework into an operational test. As business ecosystems expand and compliance expectations tighten, lifecycle management and certification cycles become harder to keep current, which is why orphaned or excessive access becomes a recurring governance failure rather than an isolated mistake.

Key questions

Q: What breaks when device lifecycle management is not tied to identity governance?

A: When device lifecycle management is isolated from identity governance, organisations lose the ability to prove who used the device, what access it carried, and whether retirement actually removed trust. That creates residual access risk through cached credentials, retained software permissions, and incomplete offboarding. The control failure is usually not the asset record itself, but the missing link between device state and identity state.

Q: Why do broad RBAC roles increase governance risk?

A: Broad roles reduce maintenance effort, but they also bundle unrelated entitlements into one access package. That makes reviews less reliable, because approvers cannot easily tell which permissions are actually needed. Over time, the role becomes a convenience label rather than a trustworthy access boundary.

Q: How do security teams know whether cloud access reviews are still effective?

A: Cloud access reviews stop being effective when reviewers are approving flattened lists instead of meaningful bindings. A useful review shows the role, scope, and downstream inheritance so the reviewer can judge actual blast radius. If the list is too large for human judgment, the control has already lost precision.

Q: Should organisations prioritise offboarding or access recertification first?

A: Offboarding should usually come first because stale access after a leaver event is immediate exposure, while recertification is a periodic control. If accounts remain active after separation, reviews are already too late to prevent that risk. Good governance sequences removal before periodic confirmation.

Technical breakdown

Why lifecycle management breaks when roles change faster than governance

Identity lifecycle management only works when joiner, mover, and leaver events are reflected quickly in entitlements and role mappings. In practice, the challenge is not provisioning alone but keeping access aligned as employees move teams, contractors end, and business relationships change. When those changes accumulate across multiple systems, RBAC becomes a coarse approximation rather than a reliable control. The article points to the governance burden created by that drift, where stale access remains active because the lifecycle process cannot keep up with organisational change.

Practical implication: treat role change and offboarding as the main stress points, not just initial provisioning.

Why access reviews become less reliable at scale

Access reviews are meant to confirm that active permissions are still necessary, but their value depends on clean inventories, accountable reviewers, and timely remediation. As identity sprawl grows, reviews become slower, less contextual, and easier to game with stale ownership data or broad role assignments. That creates a familiar IGA pattern: the review exists, but the actual governance signal is weak because the underlying access model is already out of date. In other words, certification is only as strong as the freshness of the entitlement data being reviewed.

Practical implication: focus on entitlement quality and review freshness before increasing certification frequency.

How RBAC can hide excess access instead of reducing it

RBAC is useful for simplification, but it can also conceal entitlement creep when roles are too broad, too numerous, or too detached from real job functions. The article reflects a common governance trade-off: the more an organisation relies on static roles to reduce complexity, the more likely it is to accumulate exceptions and over-assigned privileges underneath those roles. That means RBAC is not a substitute for ongoing governance. It is a structure that still needs lifecycle controls, periodic validation, and exception handling to stay trustworthy.

Practical implication: validate whether roles still map cleanly to actual work instead of assuming role design has solved governance.

Threat narrative

Attacker objective: The objective is to retain access that should have been removed or reduced, creating a governance gap that can be abused or simply left to accumulate risk.

1. Entry occurs through organisational growth, partner expansion, and identity sprawl that outpaces governance processes.
2. Escalation follows when lifecycle updates, access reviews, and role changes lag behind real user movement and offboarding.
3. Impact lands in the form of excessive or orphaned access that weakens compliance, increases operational risk, and complicates audits.

Breaches seen in the wild

• tj-actions/changed-files compromise 2025: A stolen bot token let attackers poison tj-actions/changed-files so pipelines printed their CI/CD secrets to public logs (CVE-2025-30066).

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Identity governance fails when lifecycle velocity exceeds review velocity: The article is describing a control-plane problem, not a policy problem. Joiner, mover, and leaver governance assumes that access changes can be tracked, reviewed, and remediated before they age into risk. When organisational change becomes faster than the governance cycle, certification turns into documentation of drift rather than control of drift. Practitioners should read scale as a signal to redesign governance timing, not just add more process.

RBAC becomes brittle when it is asked to do lifecycle work it was never designed to do: Roles simplify access administration, but they do not resolve entitlement freshness, exception handling, or offboarding. The article shows the familiar failure mode where role design becomes a surrogate for governance discipline. That creates broad access buckets that look controlled on paper but hide accumulated exceptions in operation. Practitioners should treat role quality as a governance asset that decays unless it is actively maintained.

Access reviews only work when the entitlement state being reviewed is still current: Review programmes often assume the inventory is accurate enough for certification to be meaningful. At scale, stale ownership, broad inheritance, and delayed revocation make the review a lagging indicator rather than a control. The result is governance theatre: a completed campaign with unresolved access sprawl underneath it. Practitioners should measure the freshness of entitlement data, not just completion rates, as the real signal of control health.

Identity governance at scale is now a resilience issue, not only a compliance issue: The article ties governance to reduced cost, smoother operations, and audit readiness, which is the right lens. Once access sprawl is large enough, every missed lifecycle event becomes operational debt as well as control debt. That means governance effectiveness should be judged by how quickly it prevents unnecessary access from persisting, not by whether the programme can produce periodic reports. Practitioners should frame IGA as an operational control loop with audit consequences, not an audit activity with operational side effects.

From our research library:

• Nearly 60% of IT leaders cite restrictive cost and complexity as a weakness of legacy identity governance, according to the 2025 State of Identity Governance Report.

What this signals

Lifecycle speed is now the governing constraint: The article’s real signal is that identity governance fails when change management, certification, and deprovisioning operate on different clocks. Once access changes can happen faster than the governance process can observe them, the programme loses precision and starts managing history instead of current risk.

Entitlement freshness is the new quality bar: In scaled environments, the question is no longer whether reviews exist, but whether the data being reviewed still matches the business reality. That shifts programme design toward faster revocation, cleaner ownership, and tighter role hygiene across the identity estate.

For practitioners

• Tighten lifecycle triggers Map joiner, mover, and leaver events to the exact systems where entitlements persist longest, then shorten the handoff between HR, managers, and IAM administration.
• Rebuild role boundaries Review broad RBAC groupings for exceptions, inherited privileges, and job-function drift, then split or retire roles that no longer reflect actual work.
• Prioritise access-review freshness Use reviewer ownership, entitlement age, and unresolved findings as the main quality checks, not just campaign completion rates.
• Reduce orphaned access exposure Track deprovisioning latency for former staff, contractors, and partners, and escalate accounts that remain active after the business relationship ends.

Key takeaways

• Identity governance weakens when lifecycle events, role changes, and access reviews move more slowly than the business environment they are meant to control.
• The article shows that RBAC and certification still matter, but they lose value quickly when entitlement data becomes stale or exceptions pile up.
• Practitioners should focus on deprovisioning speed, role hygiene, and review freshness if they want governance to stay operationally credible.

Key terms

• Identity Governance: Identity governance is the set of controls that defines who approves access, who owns it, how it is reviewed, and when it is removed. In practice, it turns identity management from a deployment task into a durable control system that can withstand audits, organisational change, and operational growth.
• Identity Lifecycle Governance: Identity lifecycle governance is the set of processes that create, change, review, rotate, and revoke access across human and non-human identities. It matters because access risk usually increases when lifecycle events are slow, incomplete, or disconnected from the systems that rely on them.
• Access Review: A formal process for confirming whether access is still needed and justified. In IAM programs, the review becomes an evidence-bearing control when decisions are recorded, scoped correctly, and traceable to the right reviewer, application owner, or auditor.
• Role-Based Access Control: A model that grants permissions by assigning identities to predefined roles. It works well when jobs are stable and access patterns are predictable, but it becomes brittle when exceptions pile up. In practice, role design must stay small enough to audit and broad enough to avoid endless custom variants.

Deepen your knowledge

NHI governance, identity lifecycle management, and secrets management are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.