Identity governance is the real test of enterprise access control

At a glance

What this is: This is a blog post arguing that identity governance is the ongoing proof that access remains appropriate, and that access reviews, certification, and attestation matter more than joiner-mover-leaver automation alone.

Why it matters: It matters because IAM teams, IGA leads, PAM teams, and security architects need evidence that access is still justified across digital and physical environments, not just that provisioning workflows executed.

By the numbers:

• More than 40 percent of executives lack visibility into access revocation outcomes, even when reviews happen, according to AlertEnterprise.

Context

Identity governance is the discipline of proving that access is still right after it has been granted, not just proving that a workflow executed. In practice, that means certification, separation of duties, and attestation must operate as continuous controls across the identity estate, not as one-time lifecycle events.

The governance gap becomes most visible when physical access is included. Many organisations can evidence digital access decisions, but badge access, facility access, and other non-digital entitlements often sit outside the same review and audit model, leaving a split control plane for identity governance.

Key questions

Q: What fails when identity governance is reduced to lifecycle automation?

A: The failure is that automation proves a workflow ran, not that the remaining access is still justified. Organisations can deprovision correctly and still leave stale entitlements, missing attestation, or unreviewed high-risk access in place. Governance requires proof of ongoing appropriateness, not just proof of change.

Q: Why do access reviews matter more when physical access is included?

A: Physical access often lives in badge or facility systems that are separate from digital IAM tools, so the review loop can break at the boundary. When that happens, an identity may be certified in one domain and invisible in another. The result is incomplete governance evidence and unresolved risk.

Q: How do organisations know whether revocation outcomes are actually visible?

A: Look for a closed audit trail that shows the entitlement, the reviewer, the decision, and the effective removal state. If teams have to reconstruct the answer from tickets, emails, or spreadsheets, revocation visibility is weak. A governance programme is only credible when it can prove the removal, not just log the request.

Q: How should security teams enforce separation of duties before access is granted?

A: Security teams should evaluate exclusion rules at request time, not just during periodic review. If a proposed entitlement creates a conflict, the workflow should block it, escalate it, or send it to a higher-trust approver. That keeps the control preventive and gives reviewers the context they need before access becomes active.

Technical breakdown

Access certification versus lifecycle automation

Access certification, also called review or attestation, validates whether existing entitlements still match role, business need, and policy. Lifecycle automation answers whether the right technical action occurred when an HR or status event happened. Those are different control objectives. A clean deprovisioning workflow does not prove that every remaining entitlement is justified, and that distinction is why governance cannot be reduced to joiner-mover-leaver automation. In mature programmes, certification evidence is the control artefact auditors and managers rely on, because it shows the organisation still agrees with the access state, not merely that the state was once changed correctly.

Practical implication: treat lifecycle automation as an input to governance, not a substitute for it.

Separation of duties across digital and physical access

Separation of duties prevents one identity from holding a toxic combination of permissions that could enable fraud, conflict of interest, or unchecked operational control. The article extends that idea beyond applications into facilities and other physical environments, where the same person may be able to approve access and enter restricted space. That is a governance problem, not just a security workflow problem. If the SoD policy engine only understands one domain, the conflict can remain invisible until audit time or an incident. Cross-domain SoD requires identity data, entitlement logic, and approval history to be evaluated together.

Practical implication: model toxic combinations across both digital roles and physical badges, not just within application silos.

Attestation evidence as the real control output

Attestation is the evidentiary layer of governance. It records approvals, denials, exceptions, and revocations so the organisation can answer who has access, why they have it, and who approved the decision. The article’s key point is that evidence often breaks when physical access sits in a separate system, because teams end up reconstructing audit trails from badge logs and spreadsheets instead of generating them continuously. Governance is therefore not just policy enforcement. It is the ability to produce reliable, timely, and complete proof that access decisions were reviewed and upheld.

Practical implication: unify audit trails so governance evidence is generated continuously rather than reconstructed after the fact.

Threat narrative

Attacker objective: The objective is to exploit governance blind spots so inappropriate access persists long enough to create operational, compliance, or fraud risk.

1. Entry occurs when an identity is granted access through normal provisioning or facility onboarding, but the organisation later loses visibility into whether that access remains justified.
2. Escalation happens when reviews, SoD checks, or attestation do not cover all entitlements, especially physical access that sits outside the digital governance layer.
3. Impact is stale or toxic access persisting beyond need, creating audit exposure, control gaps, and potential fraud or unauthorised facility entry.

Breaches seen in the wild

• Coupang Signing Key Breach: Unrevoked signing key credentials expose 33.7 million records after employee offboarding failure at Coupang.
• Internet Archive breach 2024: An exposed GitLab token opened Internet Archive code and 31 million user records; unrotated Zendesk tokens let the attacker back in weeks later.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Identity governance is not lifecycle automation with better reporting. The discipline is proving that access remains appropriate after the grant event, which means certification and attestation are the primary governance tests. If a programme can provision and revoke correctly but cannot evidence ongoing appropriateness, it has automation, not governance. The practitioner conclusion is that access proof must be treated as a first-class control objective, not a compliance afterthought.

Physical access exposes the hidden boundary of traditional IGA. Digital entitlements are often reviewable inside one governance layer, but badges, facilities, and other physical rights frequently sit elsewhere. That separation creates a governance blind spot where the same identity can be compliant in one domain and opaque in another. The practitioner conclusion is that enterprise access control is only as strong as the least-governed domain.

Separation of duties becomes materially stronger when it spans domains. A toxic combination in finance, healthcare, or sensitive facilities is not limited to application entitlements. When SoD logic ignores physical access, it fails to see the full risk graph. The practitioner conclusion is that SoD policy must be evaluated as an enterprise relationship problem, not a system-by-system checkbox.

Access revocation without visible outcomes is not closed-loop governance. The article’s cited visibility gap shows why organisations can believe a review happened while still lacking proof that the right access was removed. That is a distinct control failure because the governance loop never fully closes. The practitioner conclusion is that revocation evidence matters as much as revocation execution.

PIAM is a governance layer, not a door-control replacement. The important distinction is that PACS enforces entry at the perimeter, while governance determines whether the access should exist at all. The market signal is that identity programmes are expanding upward from provisioning into proof, and sideways into physical access. The practitioner conclusion is to evaluate whether the control stack can certify, attest, and prove access across every domain it claims to govern.

From our research library:

• 69% of security leaders agree identity management must fundamentally shift to address agentic AI systems, according to the 2026 Infrastructure Identity Survey.
• Read next: Access Reviews and Certification Guide

What this signals

Access certification has to become the centre of the identity governance programme. Lifecycle automation can still be necessary, but it does not answer the question auditors, boards, and risk teams increasingly care about: is the access still right today? Programmes that keep certification separate from provisioning are the ones most likely to discover governance gaps only after an exception, an audit request, or a control failure.

Cross-domain governance is now the practical differentiator. Digital access is usually the easy part; physical access, facility entitlements, and badge records expose whether an organisation truly governs identity or only administers it. Teams should expect pressure to unify identity evidence across systems rather than defend disconnected control planes.

Auditability is moving from after-the-fact reconstruction to continuous proof. When governance evidence is fragmented, the organisation spends time assembling answers instead of operating with confidence. That shifts the programme goal from simply detecting access changes to proving that every access decision can be justified and traced end to end.

For practitioners

• Separate provisioning from governance evidence Keep joiner-mover-leaver automation focused on changing access, but require a separate control for proving that active access is still appropriate.
• Extend certification to physical access Add badge and facility entitlements to the same review cadence used for digital entitlements, including named reviewers and revocation tracking.
• Model SoD across domains Check whether any identity can combine approval authority, entitlement administration, and physical entry rights in ways that create toxic combinations.
• Test revocation evidence quality Verify that every access review produces a durable record of what changed, who approved it, and whether the revocation actually took effect.

Key takeaways

• Identity governance is the proof that access remains appropriate, not merely the record that a workflow ran.
• The biggest control gap is often not provisioning accuracy but the inability to see whether revocation and certification actually changed the access state.
• Programmes that unify certification, attestation, and SoD across digital and physical access create a stronger governance standard than lifecycle automation alone.

Key terms

• Identity Governance: Identity governance is the set of controls that defines who approves access, who owns it, how it is reviewed, and when it is removed. In practice, it turns identity management from a deployment task into a durable control system that can withstand audits, organisational change, and operational growth.
• Access Certification: Access certification is the periodic review of whether an identity still needs its current entitlements. For NHIs, certification is only reliable when reviewers know the identity's owner, purpose, and expiry, otherwise stale machine access can persist long after the original use case has ended.
• Segregation of Duties: Segregation of Duties is a control principle that prevents one person or role from combining incompatible permissions that could create fraud, error, or undetected change. In ERP environments, it must account for roles, transactions, approvals, and compensating controls across business processes.
• Attestation: Attestation is verifiable evidence about a workload’s execution context, such as where it is running, who started it, and whether it matches policy. In agent governance, attestation can be used to bootstrap enrollment and to justify access decisions that need to change as the workload behaves differently.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.