Identity governance still breaks on manual access decisions

At a glance

What this is: This article explains why identity governance and administration still fails in organisations that manage access through manual workflows, partial automation, and fragmented records.

Why it matters: It matters because IAM, IGA, and PAM teams cannot enforce least privilege, timely revocation, or defensible certification when identity data is inconsistent across business systems.

Context

Identity governance and administration fails when access decisions depend on disconnected records, delayed updates, and manual remediation. In practical terms, the programme is trying to govern identities that are not consistently inventoried, reviewed, or revoked across business systems.

Axiad’s article argues that this creates predictable control gaps in modern enterprise environments, especially where people, applications, and devices move across on-premises, remote, and cloud contexts. The core problem is not lack of policy, but lack of a dependable operating model for identity decision-making.

Key questions

Q: What breaks when identity governance relies on spreadsheets and email approvals?

A: Access decisions lose traceability, version control, and reliable ownership. Spreadsheets can document entitlement data, but they cannot enforce review timing, prove revocation, or keep pace with cross-system change. The result is stale access, slow remediation, and weak audit evidence across the identity lifecycle.

Q: Why do stale accounts and copy-based provisioning increase access risk?

A: Because they preserve access that no longer matches business need. If a leaver account stays active or a new user inherits another person’s excessive permissions, an attacker can abuse valid access paths without needing to break authentication. That turns administrative convenience into a standing exposure window.

Q: How can teams tell whether layered identity governance is actually working?

A: Look for evidence that identity state, access reviews, privileged sessions, and monitoring outputs are aligned. If alerts, certifications, and offboarding outcomes do not connect, the organisation has control presence but not control coherence.

Q: What should IAM and IGA teams do when access decisions are still manual?

A: They should move the programme toward a single governed identity inventory, event-driven revocation, and approval processes that expose the full entitlement set before access is granted. Without that shift, the organisation is certifying incomplete data and allowing privilege drift to accumulate.

Technical breakdown

Why manual access decisions break identity governance

Manual governance breaks when access data must be assembled from spreadsheets, emails, and local system knowledge instead of a controlled identity source. That model cannot keep pace with joiner-mover-leaver changes, approval churn, or exception handling across multiple applications. Even when scripts replace part of the work, they usually automate data movement rather than governance logic, so missing notifications and stale records still create risk. The result is a programme that looks organised on paper but cannot reliably answer who has what access, why they have it, or whether it is still needed.

Practical implication: treat manual workflows as a control weakness, not an acceptable operating mode for IGA.

How provisioning oversight turns into over-privilege

Provisioning is where identity governance fails most visibly because permissions often follow the wrong precedent. When access is granted by copying another user, excessive privilege is inherited unless someone actively trims it back. If revocation depends on outdated account data, organisations leave dormant accounts active after employees leave or contracts end. That creates a standing access path that can be abused by attackers or misused internally. In governance terms, the issue is not only granting access correctly, but proving that access remains appropriate after the first approval.

Practical implication: review provisioning logic and revocation triggers together, because one without the other leaves privilege creep in place.

Why real-time identity visibility is the control that manual models lack

Identity governance depends on current knowledge of who or what can reach which systems, and that requires continuous visibility into identity state. When business units manage access locally, certification becomes a lagging exercise instead of an active control. The problem grows when people, applications, and devices all carry different kinds of entitlement evidence that are never reconciled centrally. Without real-time visibility, the programme cannot distinguish low-risk access from toxic combinations of permissions. That is why the failure is structural: the control model assumes stable, queryable identity data, while the environment produces drift, gaps, and exceptions faster than reviewers can close them.

Practical implication: build identity visibility around current entitlement state, not periodic spreadsheet reconciliation.

Threat narrative

Attacker objective: The attacker aims to exploit dormant or excessive access to reach privileged information that should no longer be available.

1. Entry begins through fragmented access administration, where inconsistent records and manual approvals allow excessive or stale permissions to persist unnoticed.
2. Credential or account abuse follows when inactive employee or contractor access remains enabled, giving an attacker a valid path into privileged information.
3. Escalation occurs through over-provisioned access that was copied from another user or never trimmed after role change, expanding the attacker’s reach.
4. Impact is the exposure of highly privileged information and the erosion of compliance controls that should have removed access before it could be abused.

Breaches seen in the wild

• Microsoft Midnight Blizzard breach: Midnight Blizzard (APT29) exploited legacy test account without MFA to breach Microsoft.
• SonicWall SSL VPN account compromises 2025: Attackers used valid credentials to log in to more than 100 SonicWall SSL VPN accounts across 16 environments in October 2025.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 150+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Manual identity governance is a control failure, not a process preference: once access decisions depend on spreadsheets, email chains, and local workarounds, the programme stops being governable at scale. The issue is not whether teams are trying hard enough, but whether the identity model still produces reliable evidence. For IAM and IGA leaders, the real question is whether access can be reviewed, corrected, and revoked without human reconstruction of the truth.

Provisioning by inheritance creates privilege drift by design: copying access from an existing user is efficient, but it also copies hidden excess and normalises over-privilege. When managers approve access without seeing the full entitlement set, the review process confirms a bad baseline instead of challenging it. That is why IGA governance must be judged by the quality of the starting data, not by the number of approvals captured.

Identity visibility is the missing operating primitive: the article shows that organisations cannot manage access they cannot see, especially when people, applications, and devices each sit in different administrative silos. Real-time identity state is not a convenience layer, it is the prerequisite for certification, revocation, and risk-based access decisions. Practitioners should treat central entitlement visibility as the condition for governance, not a reporting feature.

Adaptive governance is the only viable model for modern identity sprawl: the article’s recommended shift toward agile identity management reflects a broader discipline change, not just a tooling preference. Static review cycles cannot keep pace with role changes, contract endings, and system fragmentation across hybrid environments. The practical implication is that identity governance must become continuous, evidence-driven, and able to absorb change without relying on manual intervention.

Compliance culture is part of the control plane: the article correctly ties governance weakness to organisational behaviour, not just software design. If business units treat access as a local convenience and leadership does not enforce accountability, even strong technical controls will be bypassed in practice. For practitioners, this means governance ownership, not just policy text, determines whether identity controls hold under pressure.

From our research library:

• Nearly 60% of IT leaders cite restrictive cost and complexity as a weakness of legacy identity governance, according to the 2025 State of Identity Governance Report.

What this signals

Identity governance and administration only works when identity state is current: the article shows that spreadsheet-based administration and partial automation cannot keep pace with modern access churn. For practitioners, the signal is clear: governance must move closer to the live entitlement state, or certification will continue to lag behind reality.

Manual approval chains are not just inefficient, they are structurally bad at removing excess privilege once it has spread across multiple systems. That means IGA teams should prioritise revocation quality and identity inventory integrity before layering on more review activity.

For practitioners

• Establish a single identity inventory Create a current inventory of people, applications, and accounts so access decisions are based on one governed source of identity truth, not local spreadsheets.
• Tighten provisioning approval logic Require approvers to see the full entitlement set before granting access, and block copy-based provisioning from carrying forward unnecessary privileges.
• Automate revocation triggers Connect offboarding, contract end, and role-change events to removal workflows so stale accounts do not remain active after their business purpose ends.
• Replace spreadsheet certification with continuous review Move from periodic manual reconciliation to governance checks that reflect current access state, so reviews measure real entitlement drift instead of historical snapshots.
• Embed governance accountability in business units Assign clear owners for access decisions, exceptions, and remediation so compliance is treated as an operational responsibility rather than an occasional audit task.

Key takeaways

• Manual identity governance fails because it cannot keep identity evidence current across distributed systems.
• The article shows how inherited access, stale accounts, and delayed revocation create avoidable privilege exposure.
• Effective IGA depends on continuous visibility, governed approvals, and offboarding that actually removes access.

Key terms

• Identity Governance and Administration (IGA): A framework of policies, processes, and technology to manage and govern digital identities and their access rights. Increasingly extended to cover non-human identities alongside human users.
• Provisioning Oversight: Provisioning oversight is the control function that checks access is granted for the right reason, to the right account, at the right level. It also covers how access is reviewed, inherited, and revoked so that new entitlements do not silently inherit old mistakes.
• Access Certification: Access certification is the periodic review of whether an identity still needs its current entitlements. For NHIs, certification is only reliable when reviewers know the identity's owner, purpose, and expiry, otherwise stale machine access can persist long after the original use case has ended.
• Privilege Drift: Privilege drift is the gradual gap between the permissions an identity was meant to have and the permissions it actually retains. In AI agent environments, drift grows quickly because roles are reused, tasks change, and lifecycle reviews often lag behind deployment velocity.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.