Identity governance needs understanding, not more automation

At a glance

What this is: This is Clear Skye’s argument that identity governance fails when teams cannot reconstruct the evidence behind access decisions, especially across people, service accounts, machine identities, and AI-driven processes.

Why it matters: IAM and IGA teams need this because audits, certifications, incident response, and access cleanup all depend on explaining why access exists, not just moving requests faster.

Context

Identity governance becomes fragile when teams cannot explain why access exists, what created it, or which relationships still support it. That is a governance and evidence problem first, not an automation problem, because a decision that cannot be traced is hard to audit and harder to trust.

The article frames identity governance as a clarity gap across people, service accounts, machine identities, groups, entitlements, and AI-driven processes. As environments grow, the context needed to defend access decisions becomes scattered across systems, so teams lose the ability to reconstruct the full picture quickly.

Clear Skye argues that more automation does not fix that problem if the underlying evidence remains opaque. The real control gap is the ability to see the relationships behind access in time to make a defensible decision.

Key questions

Q: What breaks in identity governance when teams cannot explain why access exists?

A: When teams cannot explain why access exists, certifications and audits become evidence hunts instead of control checks. Reviewers end up reconstructing role, entitlement, and approval history from multiple systems, which slows decisions and weakens confidence in the result. The programme may still move, but it no longer produces a defensible answer.

Q: Why do automation and AI make identity security governance harder to manage?

A: Automation and AI increase the number of non-human actors, the speed of change, and the chances that access will outpace oversight. That creates more pressure on identity governance, privilege review, and lifecycle control. Teams need tighter boundaries around machine access, stronger approval paths, and continuous validation so access decisions remain aligned to business purpose and risk tolerance.

Q: How can security teams know if cloud identity governance is actually working?

A: The clearest signals are fewer unresolved access findings, shorter evidence-collection cycles, lower counts of stale keys, and reduced reliance on manual review. If teams still spend days reconstructing access state, governance is not operating continuously. Effective programmes can show current MFA coverage, role scope, and credential age on demand.

Q: How should IAM teams handle fragmented identity data across multiple tools?

A: They should correlate entitlement, activity, ownership, and posture data into one governance view before making recertification or SoD decisions. If each product reports only its own slice, hidden conflicts remain invisible and access reviews become procedural rather than evidentiary. The goal is not a prettier dashboard, but a defensible view of effective access across the identity estate.

Technical breakdown

Why identity governance becomes an evidence-reconstruction problem

Identity governance is often described as requests, approvals, and certifications, but the harder task is reconstructing the basis for access. Teams need to know which role, entitlement, policy, approval, or relationship produced a permission, and that information is usually distributed across systems. When context is fragmented, governance depends on manual investigation rather than reliable evidence. That makes audit, incident review, and access cleanup slower and less defensible. The article’s core point is that the system may already contain the answer, but not in a form that is immediately understandable to the people who have to approve or justify access.

Practical implication: build governance workflows around traceable evidence, not just request routing.

Why automation can amplify ambiguity in access decisions

Automation helps only when the decision logic is already explainable. In identity governance, auto-approvals or opaque recommendations can create faster decisions without improving understanding of why access exists. That is risky because governance decisions affect security, compliance, and operations, and those decisions must be defensible after the fact. If the approval path, entitlement lineage, or policy basis cannot be inspected clearly, automation can scale confusion rather than reduce it. The article’s argument is that speed without explainability does not improve governance quality; it only reduces the time available to question a weak decision.

Practical implication: require explainable decision context before increasing automation in approvals or certifications.

How platform-native context changes identity governance visibility

A platform-native model matters because governance quality depends on how much surrounding context is already available when the decision is made. If identity data has to be synchronised from elsewhere or reconstructed after the fact, teams inherit lag and inference errors. When governance runs in the same environment as IT service management, security operations, risk, and employee lifecycle processes, the relationships behind access are easier to inspect in place. That does not eliminate judgment, but it reduces the amount of detective work needed to reach it. The mechanism is visibility of context, not autonomous decisioning.

Practical implication: prioritise governance models that preserve relationship context where access decisions are made.

NHI Mgmt Group analysis

Identity governance is now a clarity discipline, not a throughput discipline. The central failure in modern governance programmes is not that teams cannot process requests fast enough, but that they cannot explain access with enough confidence to defend it. Certifications, audits, and incident response all depend on evidence reconstruction, and that is where most programmes slow down. The implication is that governance maturity now depends on whether the programme can surface meaning, not just move tickets.

AI does not repair opaque governance, it scales it. The assumption that more automation will solve identity complexity breaks when the underlying decision context is already scattered and hard to interpret. Access decisions can be executed faster, but if the rationale cannot be seen, the programme produces more decisions with less assurance. Practitioners should treat explainability as a control property, not a convenience feature.

Clear access lineage is the new governance primitive. The useful unit of governance is not the approval alone, but the chain of relationships that made the approval necessary in the first place. That includes roles, entitlements, policy conditions, and lifecycle context across identities of every type. Programs that cannot trace that lineage will continue to confuse activity with control.

Identity now spans human, machine, and process-driven access, so understanding must span all three. The article is right to frame identity as broader than employee accounts because service accounts, machine identities, and AI-driven processes often carry the riskiest permissions. Once identity extends across these actors, a narrow governance model becomes incomplete by design. Practitioners should judge maturity by whether the programme can explain access across the full identity estate.

Platform context can reduce governance friction only when it preserves auditability. Native integration helps if it keeps the evidence attached to the decision, but it does not help if context is hidden inside a black box. The control issue is not where the data sits in abstract terms, but whether a reviewer can understand the basis for the access without reconstructing it manually. The practitioner goal is transparent governance, not invisible automation.

From our research library:

• Nearly 60% of IT leaders cite restrictive cost and complexity as a weakness of legacy identity governance, according to the 2025 State of Identity Governance Report.

What this signals

Identity governance programmes should now be judged on whether they can explain access lineage at the point of review, not only on whether requests and certifications move faster. If the evidence behind a permission is not immediately visible, automation will increase scale without increasing trust.

Access lineage clarity: the practical measure of governance maturity is whether a reviewer can trace a permission back through roles, entitlements, approvals, and lifecycle context without manual reconstruction. That matters most when the estate includes service accounts, machine identities, and AI-driven processes.

For IAM leaders, the next control question is not how much more can be automated, but how much more can be understood inside the same workflow. The programme that reduces guesswork will outperform the one that only reduces queue length.

For practitioners

• Map access lineage for high-risk entitlements Document which roles, policies, approvals, and inherited relationships create access for the most sensitive accounts. Focus on the cases where reviewers currently need multiple systems to answer a single audit question.
• Require explainability before adding automation Do not expand automated approvals or certifications until the governance team can show why each access recommendation is correct and what evidence supports it. Treat explainability as a prerequisite for trust, not an afterthought.
• Unify identity context with adjacent control processes Connect identity governance evidence to service management, risk, security operations, and employee lifecycle records so reviewers can see what changed without reconstructing the story by hand.
• Separate faster decisions from better decisions Measure whether automation reduces review time without increasing the number of access questions that require manual follow-up. If reviewers still cannot explain why access exists, the programme is faster but not clearer.

Key takeaways

• Identity governance fails when teams cannot explain the basis for access quickly enough to defend it during review or audit.
• Automation alone does not fix that problem, because faster decisions without clear lineage can amplify uncertainty rather than reduce it.
• The practical control objective is to preserve accessible evidence for why access exists, what changed, and which relationships created it.

Key terms

• Identity Lineage: Identity lineage is the traceable relationship between a human owner and the non-human identities that person creates, authorises, or depends on. It allows security teams to connect service accounts, API keys, tokens, and AI agents back to accountable ownership for review, audit, and retirement decisions.
• Alert Explainability: Alert explainability is the ability to show why a monitoring system produced a specific alert and what evidence supported it. In regulated environments, it is the difference between a useful detection signal and a decision that can survive investigator review, audit scrutiny, and regulatory challenge.
• Governance Automation: Governance automation is the use of software-driven workflows to perform recurring compliance and access control tasks with less manual effort. In ERP and cloud environments, it helps standardise reviews, reporting, and exception handling while preserving oversight, evidence, and accountability for decisions.
• Platform-native governance: An identity governance model that operates inside the same platform as adjacent operational and risk processes, rather than reconstructing context from outside systems. The benefit is not autonomy, but better visibility into the evidence attached to each access decision.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.