Identity governance still breaks down under manual access control

At a glance

What this is: This article argues that identity governance fails when organisations manage access through ad hoc workflows, spreadsheets, and partial automation instead of a coordinated governance model.

Why it matters: It matters because IAM teams cannot reliably certify, revoke, or explain access when governance data is fragmented, which raises over-privilege and compliance risk across human and non-human identities.

Context

Identity governance and administration breaks down when access decisions are scattered across email, spreadsheets, and local team workflows. In that model, no one has a complete, current view of who can reach what, so remediation is slow and privileges linger after role changes or offboarding.

The article’s core point is that the problem is not just tooling cost or complexity. It is the absence of a coherent operating model that connects provisioning, certification, and revocation across systems, which leaves IAM teams unable to enforce access decisions consistently.

Key questions

Q: What breaks when fraud investigations depend on spreadsheets and ad hoc team pings?

A: The main failure is latency. By the time someone gathers the numbers, the signal may have gone cold and the fraud pattern may have shifted. That slows investigation, hides the orders driving the issue, and makes executive reporting stale. Teams also lose consistency, because different analysts may assemble different views of the same problem.

Q: Why do inherited permissions create so much identity risk?

A: Inherited permissions are risky because they transfer trust from one identity to another without proving that the new subject needs the same access. That is how privilege creep starts. In cloud, SaaS, and internal platforms, cloned entitlements often outlive the original business case and become standing exposure.

Q: What are the signs that access governance is failing in practice?

A: The clearest signs are slow remediation, repeated rubber stamp access reviews, and missed permissions outside traditional HR linked systems. If governance teams rely on manual audits, they often struggle to see access granted to non-human identities or systems adopted outside normal IT cycles. That usually means the organisation lacks reliable visibility and consistent enforcement of least privilege.

Q: How can IAM teams reduce manual work without weakening controls?

A: They should automate lifecycle events, connect access decisions to authoritative data, and measure actual remediation rather than ticket closure. The goal is not fewer controls, but fewer manual handoffs that delay provisioning and revocation. Strong automation should shorten exposure windows while preserving traceability.

Technical breakdown

Why manual access control fails at governance scale

Manual governance processes depend on humans consolidating data from multiple systems, then pushing decisions back out through email or spreadsheets. That creates delay, version drift, and gaps between what the business thinks is true and what the systems actually enforce. When access data is assembled outside the authoritative systems, certification becomes an after-the-fact reconciliation exercise rather than a control point. The article also shows why partial automation does not solve the problem if it still leaves data gaps or notification gaps. Practical implication: governance needs an integrated source of truth, not just faster document handling.

Practical implication: replace spreadsheet-driven certification with governance workflows that are tied to authoritative identity and access data.

How provisioning errors turn into over-privilege

Provisioning becomes risky when new access is granted by copying from an existing user or when managers approve access without understanding the full entitlement set. That pattern propagates excessive permissions from one account to the next, especially when role changes and offboarding are not tightly connected to revocation. The article’s warning is that stale accounts and inherited access are not edge cases; they are a normal outcome when lifecycle information is incomplete. Practical implication: provisioning controls must be linked to joiner-mover-leaver events and reviewed against actual entitlement scope.

Practical implication: bind provisioning and deprovisioning to lifecycle events so inherited access does not survive role changes or offboarding.

Why compliance culture matters in access governance

IGA is not only a technical control problem. The article stresses that governance fails when business units treat access decisions as isolated local tasks instead of a shared compliance discipline. Without leadership pressure and recurring accountability, teams default to convenience, which leaves control ownership unclear and reviews inconsistent. That is why policy design alone does not create governance maturity. Practical implication: access governance needs operating rhythm, ownership, and escalation paths, not just a written policy.

Practical implication: assign explicit governance ownership and review cadences so access decisions cannot drift into local convenience.

Threat narrative

Attacker objective: The attacker objective is to exploit excessive or stale access to reach systems and data that should no longer be available through that account.

1. Entry occurs through fragmented identity administration, where access is created or extended based on incomplete data and local team decisions rather than governed lifecycle controls.
2. Credential or privilege exposure follows when inherited permissions, stale accounts, and delayed removals leave excess access active beyond the business need.
3. Escalation happens as over-privileged accounts accumulate broader reach across systems, making unauthorized access easier if one account is misused or compromised.
4. Impact is realised through harder compliance, weaker visibility, and a larger attack surface for data exposure or account abuse.

Breaches seen in the wild

• SonicWall SSL VPN account compromises 2025: Attackers used valid credentials to log in to more than 100 SonicWall SSL VPN accounts across 16 environments in October 2025.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 150+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Manual governance is the control failure, not just a process inconvenience: This article shows that spreadsheet-led access administration and ad hoc approvals do not scale into real identity governance. When the operating model is fragmented, certification is retrospective, revocation is delayed, and no team has a reliable view of effective access. The practitioner conclusion is that governance must be treated as a control system, not a document workflow.

Provisioning by inheritance creates privilege creep by design: Copying access from an existing user and approving changes without entitlement context reproduces excess access at scale. That is not a side effect of poor discipline, it is the predictable result of incomplete lifecycle control. The implication is that access decisions must be evaluated against role change and offboarding, not just initial joiner setup.

Compliance culture is part of the security architecture: The article correctly ties governance failure to the absence of business-wide accountability. When leadership treats access reviews as a back-office task, teams optimise for speed and convenience instead of traceability. The practitioner implication is that control ownership, escalation, and recurring review cadence are structural requirements, not optional process layers.

Identity governance still needs a single authoritative operating model: identity governance and administration only works when provisioning, certification, and revocation are connected to the same source of truth. Fragmented tooling can automate fragments of the workflow, but it does not solve the governance gap if decisions are still made outside the system of record. Practitioners should view integration as the prerequisite for governance maturity, not a feature enhancement.

From our research library:

• Nearly 60% of IT leaders cite restrictive cost and complexity as a weakness of legacy identity governance, according to the 2025 State of Identity Governance Report.

What this signals

Identity governance breaks first at the coordination layer: the article shows that the real failure is not a missing spreadsheet but a missing operating model. Once provisioning, certification, and revocation are handled independently, access control becomes slow, inconsistent, and hard to audit.

Governance maturity depends on lifecycle discipline: access decisions only stay accurate when joiner, mover, and leaver events are connected to the same entitlement process. Without that linkage, excess access and delayed removal become normal rather than exceptional.

For practitioners

• Replace spreadsheet-led access reviews Move certification, revocation, and exception handling into an identity governance workflow tied to authoritative account and entitlement data. That reduces version drift and makes reviewer decisions auditable.
• Bind access changes to lifecycle events Connect joiner, mover, and leaver events to provisioning and deprovisioning so inherited permissions are reassessed whenever a role or contract changes.
• Audit inherited and copied access Look for accounts created by cloning existing users, then compare those entitlements to business role requirements and remove access that has no current justification.
• Set governance ownership across business units Assign clear owners for access approvals, recertification, and exception escalation so governance does not fragment into local practice.
• Review stale accounts and delayed removals Identify accounts that remain active after employment or contract changes and measure how long revocation takes after the need for access ends.

Key takeaways

• Manual identity governance breaks down because fragmented workflows cannot maintain a current view of access or evidence of control.
• The article points to over-privilege, delayed revocation, and weak cross-system coordination as the core failure modes.
• Identity teams need lifecycle-linked governance, not spreadsheet remediation, if they want access reviews and compliance to hold up.

Key terms

• Identity Governance and Administration (IGA): A framework of policies, processes, and technology to manage and govern digital identities and their access rights. Increasingly extended to cover non-human identities alongside human users.
• Privilege Creep: Privilege creep is the gradual accumulation of access rights beyond what an identity actually needs. It usually happens when permissions are added for convenience and never removed. For NHIs, privilege creep expands blast radius and makes old credentials far more dangerous than their original purpose suggests.
• Joiner Mover Leaver: Joiner Mover Leaver is the identity lifecycle process for creating, changing, and removing access as people enter, change roles, or leave an organization. It governs provisioning, modification, and deprovisioning across systems, ensuring access matches current job needs and reducing orphaned accounts, privilege creep, and residual access risk.
• Access Certification: Access certification is the periodic review of whether an identity still needs its current entitlements. For NHIs, certification is only reliable when reviewers know the identity's owner, purpose, and expiry, otherwise stale machine access can persist long after the original use case has ended.

Deepen your knowledge

NHI governance, identity lifecycle management, and secrets management are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.