Identity governance is now the control plane for zero trust

At a glance

What this is: This is an Omada Identity blog analysis arguing that modern identity governance is the control plane that makes zero trust operational, because manual reviews and delayed access changes leave access excessive and unverified.

Why it matters: It matters because IAM teams have to keep access aligned to role, timing, and risk across human, service, and automated identities if zero trust is to stay enforceable rather than aspirational.

By the numbers:

• Cybercrime is predicted to cost the world around $10.5T in 2025, which would rank it as the world's third-largest economy if measured by GDP today.
• Around 40% of organisations still operate with outdated IGA.

Context

Zero trust depends on explicit verification and minimum access, but manual provisioning and periodic access reviews often lag behind real job changes and real attacker speed. When identity becomes the practical control plane for SaaS, cloud workloads, on-prem systems, and automated processes, governance has to keep pace with the same tempo as the business.

This article argues that identity governance and administration is what makes zero trust operable in daily work. The problem is not the idea of zero trust itself, but the way stale entitlements, delayed offboarding, and low-context review workflows leave access too broad for too long.

Key questions

Q: What breaks when Zero Trust is implemented without identity governance?

A: Zero Trust breaks when the policy engine is enforcing stale or incomplete identity data. If access approvals, ownership, and revocation are not governed, the organisation keeps validating entitlements that no longer match business intent. The result is technically strong enforcement built on weak identity records, which still leaves over-privileged accounts and hidden exceptions in place.

Q: Why does permission creep increase breach impact?

A: Permission creep increases breach impact because compromised identities often retain access from previous roles or projects, giving attackers more paths than the current job actually requires. That wider entitlement set expands the blast radius of compromise and makes containment harder. Security teams should treat stale access as a direct contributor to incident severity, not just an audit issue.

Q: How do teams know if automated access reviews are actually working?

A: Automated reviews are working when exception rates fall, reviewer overrides become rare, and access decisions are grounded in clean role definitions rather than ad hoc exceptions. If certifications keep surfacing the same noisy entitlements, the problem is usually role design, not reviewer effort. Effective automation should reduce ambiguity, not scale it.

Q: Should organisations prioritise offboarding over onboarding features?

A: They should prioritise the controls that prevent stale access from surviving role changes and departures. Onboarding efficiency matters, but the larger governance risk usually comes from access that remains usable after the business relationship has changed.

Technical breakdown

Why manual identity reviews weaken zero trust

Zero trust assumes every access decision is evaluated in context, yet manual reviews usually compress that decision into a manager's quick approval of a long entitlement list. That creates rubber-stamp behaviour, where verification exists in process form but not in substance. The result is not just audit noise. It is a governance layer that cannot keep pace with role changes, contractor churn, or application sprawl. Modern identity governance has to convert access review from an episodic admin exercise into a continuously informed control over who should keep what access and why.

Practical implication: replace context-poor review campaigns with evidence-backed certification workflows that surface usage, role change, and risk signals before approval.

How identity governance limits blast radius

Blast radius is the amount of damage a compromised identity can cause once an attacker gets a foothold. In identity-heavy environments, that radius expands when users retain permissions from previous jobs, departments, or projects. Governance reduces that exposure by removing outdated entitlements and aligning access to current responsibilities. This is especially important where one identity can span business apps, cloud workloads, and sensitive internal systems. The control is not just privilege reduction. It is containment of what a compromised account can reach before the attack spreads laterally.

Practical implication: recertify role changes and leaver access fast enough that compromised identities do not carry yesterday's privileges into today's environment.

How AI changes identity governance for zero trust

AI does not replace governance, but it does change the operating model by making access decisions more scalable and more evidence-driven. In zero trust terms, that matters because continuous verification becomes difficult when humans must review thousands of entitlements without context. AI-assisted governance can highlight anomalies, cluster access into cleaner role patterns, and flag unused permissions that would otherwise survive review cycles. The useful shift is not automation for its own sake. It is faster, better-informed governance at the pace required by modern identity estates.

Practical implication: use AI-assisted recommendations to focus reviewers on the access decisions that actually change risk, especially at enterprise scale.

Threat narrative

Attacker objective: The attacker aims to turn one compromised identity into broad, persistent access that increases the blast radius of the breach.

1. Entry begins when an attacker takes over a legitimate identity, such as an employee, contractor, bot, or service account, rather than exploiting malware alone.
2. Credentialed access becomes more valuable when that identity still carries outdated permissions from prior roles or unresolved offboarding.
3. Escalation occurs as the attacker uses overbroad access to move into sensitive systems that the current role should no longer reach.
4. Impact is amplified because the compromised identity's lingering privileges enlarge the breach instead of containing it.

Breaches seen in the wild

• Salt Typhoon telecom intrusions 2025: Salt Typhoon breached US telecoms mainly with stolen logins, then harvested SNMP strings and TACACS/RADIUS keys to spread and persist for years.
• Sisense breach 2024: A credential in Sisense's GitLab reportedly opened S3 buckets of customer tokens, passwords and certificates; CISA urged a full reset.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Identity governance has become the practical control plane for zero trust. Zero trust is not operational until identity decisions are current, explicit, and continuously right-sized. When access is managed through stale entitlements or ticket-driven delay, the policy model says one thing and the runtime environment does another. Practitioners should treat governance as the mechanism that keeps trust decisions coherent across the estate.

Permission creep is not an efficiency problem, it is a blast-radius problem. Every outdated entitlement extends what a compromised identity can do after initial access. That is why access drift matters across employees, contractors, bots, and service accounts alike. The discipline is to see excess privilege as a containment failure, not a paperwork issue.

Access review without context is governance theater. Rubber-stamp certification turns verification into a compliance ritual rather than a security control. The article's core point is that scale and speed now demand evidence-rich reviews, not larger review queues. Teams should measure whether certification changes decisions, not whether the campaign was completed.

AI-assisted governance changes the economics of keeping trust current. The article correctly places AI as an accelerator for review quality and entitlement hygiene, not as a substitute for accountability. That matters because zero trust depends on timely decisions, and human-only review models degrade as identity estates grow. Practitioners should use AI to narrow review scope and preserve decision quality where risk is highest.

Modern identity governance is now the difference between theory and enforceability. Zero trust assumes identities are verified, least privilege is current, and access changes track business change. In practice, the organizations that cannot govern identity lifecycle fast enough will keep inheriting unverified access, regardless of how strong the perimeter story sounds. The program question is no longer whether to adopt zero trust, but whether identity governance can make it real.

From our research library:

• 90% of IT leaders say properly managing NHIs is essential for a successful zero-trust implementation, according to the Ultimate Guide to NHIs.
• Read next: Access Reviews and Certification Guide

What this signals

Identity governance is now the enforcement layer that keeps zero trust from collapsing into policy language only. When access changes lag behind role changes, the programme still looks controlled on paper but behaves loosely in production. Teams should watch for any process where review cadence is slower than employee mobility or workload churn.

Blast-radius control becomes the real test of governance quality. If a compromised identity still carries yesterday's entitlements, the organisation has not reduced risk, only documented it. That is why mover and leaver processing deserves more attention than periodic attestation alone.

Access review quality, not review volume, is the signal that matters. The useful question is whether certification decisions actually remove stale permissions and prevent recurrence in the next cycle. If not, the identity programme is auditing drift instead of correcting it.

For practitioners

• Tighten access certification around role change Trigger certification when a user changes role, project, or department, not only on a calendar. Focus reviewers on entitlements that are no longer justified by current responsibilities.
• Automate joiner-mover-leaver adjustments Remove delayed manual provisioning paths for joiners, movers, and leavers so access reflects current job status rather than legacy assignments.
• Treat stale entitlements as containment risk Prioritise cleanup of excess access on identities that can reach finance, procurement, cloud workloads, or other high-impact systems.
• Use AI to reduce review noise Apply AI-assisted recommendations to cluster similar access, flag unused permissions, and surface anomalies before reviewers approve them.

Key takeaways

• Identity governance is the practical control layer that makes zero trust enforceable across changing roles and identities.
• The article ties weak governance to a very large cybercrime economy and to the persistence of outdated access, both of which enlarge breach impact.
• The decisive improvement is faster entitlement correction, especially when roles change, access ages, or identity risk increases.

Key terms

• Identity Governance and Administration (IGA): A framework of policies, processes, and technology to manage and govern digital identities and their access rights. Increasingly extended to cover non-human identities alongside human users.
• Permission Creep: The gradual accumulation of access beyond what a user or workload currently needs. It usually happens because initial approvals are never fully removed or recertified. In practice, permission creep is a lifecycle failure that turns temporary exception access into de facto standing privilege.
• Blast Radius: The potential scope of damage if a specific credential or identity is compromised. Identities with broad permissions have a larger blast radius and represent a higher priority for least-privilege enforcement and security controls.
• Rubber-stamp Review: A rubber-stamp review is an access certification process where approvers validate large lists of entitlements without enough context to make a real decision. It produces compliance activity, but it does not reliably remove risk or improve trust decisions.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.