TL;DR: Traditional identity governance still leaves many enterprises with poor visibility, slow deployment cycles, and identity debt as cloud, legacy, OT, and AI-connected environments expand, according to Gathid’s analysis. The real shift is from one-time implementation to continuous, contextual governance across the full identity estate.
At a glance
What this is: This article argues that identity governance is shifting from a one-off programme to a daily operational discipline because static tool deployments cannot keep pace with modern identity sprawl.
Why it matters: That matters to IAM, IGA and PAM teams because governance gaps now emerge continuously across human, NHI and autonomous-adjacent environments, not just at implementation time.
By the numbers:
- Full IGA can take 12 to 24 months to reach phase one of deployment, according to Gathid.
Context
Identity governance is the set of controls that answer who has access to what, whether that access is still justified, and what changed since the last review. In this article, Gathid argues that the old project-based model is failing because access changes faster than governance programmes can keep up.
The core governance gap is not lack of intent. It is the mismatch between static implementation cycles and environments that now span cloud, legacy applications, OT, physical systems, and AI-connected identities. That makes identity debt a daily accumulation problem, not a periodic cleanup problem.
The article frames light IGA and full IGA as two ends of a spectrum, but most enterprises operate in the middle and need continuous observability rather than a one-time deployment milestone. That is a typical operating reality, not an edge case.
Key questions
Q: When does light IGA stop being enough for an identity programme?
A: Light IGA stops being enough when the environment includes conflicting sources of truth, segregation-of-duties enforcement, toxic access checks, legacy applications, or OT systems that require deeper policy reconciliation. At that point, fast deployment is not the deciding factor. Governance depth, exception handling, and entitlement accuracy matter more than basic provisioning speed.
Q: Why does identity debt keep growing even after governance tools are deployed?
A: Identity debt grows because access changes continuously while many governance programmes still operate on project timelines. New apps, staffing moves, acquisitions, and system changes create new entitlements faster than reviews can remove stale ones. If the programme only checks access periodically, unresolved drift becomes normal instead of exceptional.
Q: How should organisations decide between Light IGA and Full IGA?
A: They should decide based on governance scope, not feature labels. If the environment needs entitlement catalogues, role engineering, segregation of duties enforcement, or coverage across disconnected systems, lightweight governance will not be enough. If the estate is simple, cloud-connected, and already visible, Light IGA may cover the immediate need while a fuller roadmap is built.
Technical breakdown
Why light IGA covers basics but not deep governance
Light IGA is usually bundled into larger cloud identity suites and is designed for fast deployment, provisioning, single sign-on, and access reviews. The trade-off is that it optimises for breadth and speed, not for complex governance patterns such as segregation of duties, toxic access analysis, legacy system entitlements, or multiple sources of truth. In practice, that means it can report and certify known access, but it struggles when governance must reconcile conflicting systems or policy exceptions across a broad estate.
Practical implication: use light IGA where the main need is basic lifecycle control, but do not expect it to govern advanced entitlement complexity.
Why full IGA often underdelivers in the first year
Full IGA platforms promise granular policy automation and audit-ready workflows, but they typically demand substantial configuration and consulting before they become operational. The long implementation cycle matters because governance requirements do not pause while the programme is being built. During that gap, manual reviews, spreadsheets, and scripts tend to fill the void, which increases the chance that access drift becomes normalised before the platform reaches steady state.
Practical implication: treat time-to-value as a governance risk and plan interim controls for the period before phase one is live.
Why identity debt grows faster than traditional governance models
Identity debt is the accumulation of outdated, unmanaged, or excessive access rights and entitlements. It grows because every acquisition, staffing change, new SaaS deployment, and infrastructure shift creates new entitlements faster than teams can recertify and remove them. Once governance is treated as an episodic project, the backlog compounds: the control environment becomes less accurate, reviews become less trustworthy, and remediation becomes more expensive than early correction.
Practical implication: design governance as a living control process that continuously removes stale access instead of periodically cleaning up after it.
NHI Mgmt Group analysis
Identity governance has crossed from implementation problem to operating model problem. The article is right to move the discussion away from buying a platform and toward embedding governance into daily work. That shift matters because the main failure mode is no longer feature coverage alone, but the delay between identity change and governance response. Practitioners should treat continuous observability as the baseline assumption for modern IGA.
Identity debt is the right name for the accumulation problem, but the real issue is control lag. Access changes now happen faster than manual audits, spreadsheet workflows, or annual projects can reflect them. That lag creates a governance blind spot across cloud, legacy, OT, and physical environments. The practitioner conclusion is simple: if governance cannot see change quickly, it cannot govern change at all.
Light IGA and full IGA are not opposing philosophies so much as different control depths. Light IGA handles low-complexity lifecycle and review needs; full IGA becomes necessary where policy conflict, SoD, and multiple systems of record must be reconciled. The important programme decision is not which label sounds better, but where the organisation's identity estate has outgrown shallow controls.
Continuous contextual governance: The article’s strongest contribution is the case for governance that follows access in real time, not on a schedule. That idea becomes even more important as AI-connected identities and machine access expand the scope of who and what needs review. The practitioner takeaway is to align governance cadence to change velocity, not to audit convenience.
Daily practice is now the governance threshold, not an optimisation target. Once access becomes dynamic, the old project mindset creates identity debt by design. The organisations that will manage risk better are the ones that treat governance as an always-on operating discipline spanning human, non-human, and increasingly automated access patterns.
What this signals
Continuous governance is becoming the real control plane for identity. Organisations can no longer rely on periodic reviews to keep access accurate because identity changes now arrive continuously across human, NHI, and machine-driven workflows. The programme question is shifting from whether governance exists to whether it can keep pace with operational change.
Identity debt is a leading indicator of governance failure. Once excessive access, stale entitlements, and manual remediation become routine, the programme is paying interest on every delayed decision. Teams should watch backlog age, unresolved exceptions, and deprovisioning lag as signals that governance has become reactive.
Light and full IGA are best understood as different control depths, not competing slogans. The practical task is to map access complexity to governance depth and to stop forcing shallow tooling into environments that need SoD, multiple sources of truth, or cross-domain entitlement correlation.
For practitioners
- Implement continuous access observability Track entitlement changes as they happen across cloud, legacy, OT, and SaaS environments so governance decisions are based on current state, not last quarter's export.
- Segment governance by use case depth Use light IGA for straightforward provisioning and access reviews, but reserve full governance workflows for SoD, toxic access checks, and multiple-source reconciliation.
- Measure identity debt as a live risk Create metrics for stale entitlements, overdue deprovisioning, and unresolved access exceptions so the backlog is visible before it becomes operational debt.
- Bridge manual cleanup gaps Replace one-time audit cleanup cycles with recurring removal of outdated access, especially after staffing changes, acquisitions, and new application onboarding.
Key takeaways
- Identity governance fails when it is treated as a one-time implementation rather than a daily control process.
- The article highlights a structural gap between quick light IGA use cases and the deeper governance work required in complex estates.
- Teams should measure identity debt continuously and align governance depth to the complexity of the access model they actually operate.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST CSF 2.0, CIS Controls v8 and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST CSF 2.0 | GV.OC-01 — Organizational Context | The article is about governance operating model and organisational context for identity control. |
| PR.AA-05 — Access Permissions, Entitlements and Authorizations | The post centres on keeping entitlements current across changing identity states. | |
| GV.RM-01 — Risk Management Strategy | Identity debt is framed as an accumulating governance risk requiring an operating strategy. | |
| Recommendation — Document governance scope and identity context so access decisions align with operational reality. Review and update access permissions continuously instead of relying on episodic certification. Treat identity debt as an ongoing risk metric in the governance strategy. | ||
| CIS Controls v8 | CIS-5 — Account Management | The article is fundamentally about managing changing access across the identity estate. |
| Recommendation — Use account management controls to remove stale access and keep identity records current. | ||
| NIST SP 800-53 Rev 5 | AC-6 — Least Privilege | Excess and outdated access rights are the core problem described in the article. |
| Recommendation — Enforce least privilege by shrinking standing access and reviewing exceptions continuously. | ||
Key terms
- Light IGA: Light IGA is a reduced identity governance model that covers the essentials of access lifecycle and request handling. It usually trades depth for simplicity, offering faster deployment and lower administration overhead, but less flexibility for complex entitlements, nuanced policy, and audit-grade evidence.
- Full IGA: Full IGA is a comprehensive identity governance model that aims to manage entitlements, workflows, segregation of duties, and richer analytics across a complex enterprise. It is typically better suited to large and diverse environments, but it usually requires extensive integration and longer delivery cycles.
- Identity Debt: Identity debt is the accumulation of unowned, over-permissioned, or poorly governed non-human identities that security teams cannot cleanly inventory or retire. It usually grows when experimentation outruns access governance, leaving service accounts and tokens active long after their original purpose has passed.
- Continuous governance: An identity governance model that checks and enforces policy as activity happens rather than on a schedule. It is designed to catch drift, misuse, and orphaned access while the identity is still active, which matters when risk unfolds in minutes instead of review cycles.
Deepen your knowledge
NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.
Published by the NHIMG editorial team on June 11, 2026.
Updated on October 10, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org