TL;DR: Clarity Security argues that identity has become the cloud perimeter, but many organisations still govern access with fragmented reviews, siloed visibility, and manual decisions that leave excessive entitlement, stale accounts, and unclear ownership in place. The control gap is after entry, where access governance functions like a firewall with open ports and an underestimated blast radius.
At a glance
What this is: This is an analysis of why identity governance, not authentication, is the weak point in cloud access control when identity becomes the perimeter.
Why it matters: IAM, IGA, and PAM teams need to treat entitlement visibility, ownership, and review quality as perimeter controls because post-authentication governance determines blast radius.
👉 Read Clarity Security's analysis of identity governance as the cloud firewall gap
Context
Identity governance is the set of controls that decide who keeps access, why they keep it, and whether that access still matches current need. In cloud environments, the problem is rarely initial authentication. The failure point is what happens after entry, when stale entitlements, orphaned accounts, and unused group memberships remain active.
The article frames this as a firewall problem because access without governance expands the blast radius even when SSO, MFA, and conditional access are in place. That makes the issue directly relevant to IAM and IGA programmes that still rely on fragmented reviews and manual context gathering.
Key questions
Q: How should teams close the governance gap after authentication in cloud environments?
A: Treat post-authentication governance as the control that limits blast radius, not as a cleanup exercise. Teams should tie every standing entitlement to an owner, a business purpose, and a review path, then remove access that no longer matches role, usage, or accountability. Without that, SSO and MFA only confirm entry while privilege keeps expanding.
Q: Why do stale accounts and unused groups increase cloud risk?
A: Stale accounts and unused groups widen the blast radius because they preserve reachable access paths that no longer match current job duties or system needs. Attackers and insiders benefit from privilege that remains valid but unmonitored. The longer that access persists, the harder it becomes to distinguish legitimate from dangerous entitlement.
Q: What are the signs that identity governance is not working in practice?
A: Common warning signs are repeated access workarounds, ignored approval workflows, super admins holding too much power, and teams bypassing the process because it is too slow or hard to use. If access reviews are always behind, permissions stay stale, and IT has to chase owners for answers, governance is operating more as paperwork than control.
Q: Should organisations prioritise access review coverage or access review quality?
A: Quality should come first when access reviews are manual or context-poor. A partial review process can create more confidence than control, especially if it misses privileged roles, dormant accounts, or service identities. Teams should review the most risk-heavy access paths with enough context to make removal decisions, not just tick completion boxes.
Technical breakdown
Why identity governance becomes the post-authentication control point
Once users, apps, and workloads are inside the cloud environment, authentication no longer limits what they can reach. Identity governance determines whether access remains aligned to role, ownership, and business need. In practice, that means entitlement review, access certification, and account ownership become the effective enforcement layer after login. When those controls are fragmented, the perimeter still exists, but it has no reliable way to shrink access that is no longer justified.
Practical implication: Treat access governance as the control that constrains post-login reach, not as an administrative cleanup activity.
How open ports appear in identity and access estates
An open port in this article is any standing permission that should no longer exist. Excessive entitlement, stale accounts, unused group membership, and over-permissioned service accounts all keep the attack surface alive even when the authentication layer is strong. The technical problem is not that access was granted once, but that lifecycle and review controls failed to remove it when context changed. That is why the blast radius keeps growing silently in cloud programmes.
Practical implication: Inventory standing access that has outlived its business purpose and tie every entitlement to an owner and review path.
Why adaptive context beats static access rules
Static rules cannot answer the questions that matter once identity is the perimeter. Whether access is still used, whether it maps to the current role, and who is accountable for it are context-dependent decisions. Adaptive governance brings usage signals, ownership, and role alignment into the review process so access can be reduced based on current evidence instead of old assumptions. Without that context, governance stays manual and incomplete, which is exactly how open ports persist.
Practical implication: Use contextual signals in access decisions so reviews can remove obsolete access instead of merely documenting it.
Breaches seen in the wild
- Azure Key Vault Contributor escalation 2024: Datadog found Azure Key Vault Contributor could add itself to access policies and read every secret, key and certificate in a vault.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 150+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Identity governance is the real firewall in cloud environments. Authentication controls secure the front door, but they do not reduce what a user can reach after entry. Once entitlement sprawl, stale accounts, and unmanaged group membership accumulate, the effective security boundary moves to governance. Practitioners should treat access certification and ownership as perimeter controls, not back-office hygiene.
IGA Lite is not a programme, it is a control gap. Partial reviews and siloed visibility create a false sense of coverage while leaving large parts of the access estate untouched. That pattern is especially dangerous in cloud programmes because users, applications, and data shift faster than manual governance can follow. The implication is that review completeness matters more than review volume.
Context is the missing control plane for post-authentication access. Access decisions that do not incorporate usage, role fit, and accountable ownership are structurally blind. This is where identity programmes break down: they know who authenticated, but not whether that access still deserves to exist. Practitioners need governance that can explain and justify each standing entitlement, not just list it.
Open ports is a useful name for entitlement drift. The phrase captures how unused permissions, stale accounts, and over-permissioned service identities behave like exposed network ports, only with slower and less visible failure modes. That makes the issue harder to detect and easier to normalise. The practitioner conclusion is simple: if the entitlement can stay open indefinitely, the perimeter is already leaking.
Cloud security teams should stop separating identity control from access control. In cloud programmes, identity is the perimeter only if governance continuously narrows privilege after authentication. Without that, SSO, MFA, and conditional access merely verify entry while the real exposure grows elsewhere. The field should recognise governance quality as a security outcome, not an audit afterthought.
What this signals
Identity governance is now a perimeter discipline. Cloud programmes that still treat reviews as periodic administration will continue to accumulate standing privilege faster than they can rationalise it. The practical shift is to make ownership, usage, and entitlement age visible enough that access can be reduced continuously rather than rediscovered later.
Open ports is the right mental model for entitlement drift. It captures why access that no one actively uses can still become a security exposure, especially when service accounts and dormant users are not governed with the same rigour. Practitioners should expect cloud attack paths to exploit forgotten access before they exploit sophisticated controls.
For practitioners
- Map standing access to named owners Build an entitlement inventory that identifies the business owner, technical owner, and review cadence for every persistent permission, including stale accounts and group memberships.
- Prioritise excessive entitlement removal Focus first on permissions that grant admin, cross-environment, or broad data access because those items expand blast radius fastest when they remain active.
- Replace manual review queues with context-driven decisions Use current usage, role alignment, and last-access evidence to decide whether access should stay, shrink, or be revoked instead of relying on static certification checklists.
- Tighten governance for service accounts and dormant users Include non-human identities and inactive human accounts in the same access governance workflow so overlooked credentials do not become hidden open ports.
Key takeaways
- Identity governance determines whether cloud access stays aligned to business need after authentication, which makes it a frontline security control rather than an administrative afterthought.
- Fragmented reviews, stale accounts, and unclear entitlement ownership leave hidden exposure in place and expand the blast radius of any compromised identity.
- The most effective response is to make access ownership, usage, and review context visible enough to drive timely removal decisions.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 addresses the attack and risk surface, while NIST CSF 2.0, NIST SP 800-53 Rev 5, CIS Controls v8 and NIST Zero Trust (SP 800-207) set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-05 — Overprivileged NHI | The article's open ports model maps directly to standing excess privilege in non-human access. |
| Recommendation — Review non-human entitlements for overprivilege and remove standing access that no longer has a business need. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | The piece is fundamentally about governing entitlements after authentication in cloud environments. |
| Recommendation — Use PR.AA-05 to validate that permissions remain justified, owned, and appropriately limited. | ||
| NIST SP 800-53 Rev 5 | AC-6 — Least Privilege | Excessive entitlement and stale access are direct least-privilege failures. |
| Recommendation — Apply AC-6 to reduce standing permissions and remove access that exceeds current role requirements. | ||
| CIS Controls v8 | CIS-5 — Account Management | The article highlights dormant accounts, ownership gaps, and manual lifecycle management. |
| Recommendation — Use CIS-5 to maintain account ownership, remove stale access, and govern dormant identities. | ||
| NIST Zero Trust (SP 800-207) | Least privilege access principle — Least privilege access principle | The article's firewall analogy depends on continuously limiting access after entry. |
| Recommendation — Apply the least privilege principle to shrink access dynamically as context changes. | ||
Key terms
- Identity Governance: Identity governance is the set of controls that defines who approves access, who owns it, how it is reviewed, and when it is removed. In practice, it turns identity management from a deployment task into a durable control system that can withstand audits, organisational change, and operational growth.
- Blast Radius: The potential scope of damage if a specific credential or identity is compromised. Identities with broad permissions have a larger blast radius and represent a higher priority for least-privilege enforcement and security controls.
- Standing Privilege: Standing privilege is access that remains active even when no immediate task requires it. For NHI programmes, it is a common failure mode because long-lived credentials and persistent roles create unnecessary exposure. Reducing standing privilege usually means tighter expiry, on-demand access, and clearer review of who or what still needs access.
- Entitlement Drift: Entitlement drift is the slow accumulation of permissions that no longer match the original purpose, role, or workload. In cloud-native and NHI-heavy environments, it usually happens because access changes faster than review cycles, leaving organizations with more privilege than they intended.
What's in the full article
Clarity Security's full article covers the operational detail this post intentionally leaves for the source:
- The article's plain-language mapping of “open ports” to specific entitlement conditions that create risk in cloud programmes.
- The governance questions it suggests for access owners when deciding whether access should stay, shrink, or be revoked.
- The discussion of why SSO, MFA, and conditional access are table stakes but do not solve post-login governance.
- The framing of a unified identity, access, and context model for teams trying to reduce blast radius.
Deepen your knowledge
NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.
Published by the NHIMG editorial team on August 17, 2026.
Updated on October 7, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org