TL;DR: Nexis argues that many IAM and IGA programmes still lack an accurate, actionable view of how identities, roles, and entitlements behave across the enterprise, leaving hybrid RBAC and ABAC governance too static for changing access patterns. Static review cycles no longer match operational reality, so visibility and continuous optimization become the control plane, not periodic cleanup.
At a glance
What this is: NHI Mgmt Group's analysis, drawing on Nexis's blog post: Visibility into identity, role, and entitlement behaviour is the missing layer in modern authorization.
Why it matters: It matters because IAM and IGA teams cannot govern hybrid RBAC and ABAC effectively if they only see point-in-time records rather than how access actually changes.
👉 Read Nexis's analysis of identity visibility gaps in modern IAM and authorization
Context
Modern authorization often fails because governance tools capture assignments but not behaviour. When roles, attributes, and entitlements change faster than review cycles, teams lose the operational picture they need to manage access as a living system rather than a static catalogue.
Nexis frames identity visibility as the bridge between IAM data and business-ready governance. The article argues that hybrid RBAC and ABAC, continuous optimization, and no-code workflows are needed to keep authorization aligned with organisational change.
The core problem is not the absence of policy language. It is the absence of trustworthy, actionable visibility that can show where access overlaps, where entitlements drift, and where governance controls no longer reflect how the enterprise actually operates.
Key questions
Q: How should IAM teams govern hybrid RBAC and ABAC models?
A: They should govern both models through the same approval, versioning, and evidence process. RBAC gives business structure, while ABAC adds contextual policy logic, so the control objective is consistency and explainability. If teams split them into separate governance tracks, policy sprawl and review inconsistency usually follow.
Q: What breaks when identity visibility is too weak for modern authorization?
A: Teams end up certifying snapshots instead of governing live access behaviour. That leads to stale roles, hidden overlap, redundant entitlements, and weak accountability because the programme cannot show how access actually changes between review cycles.
Q: How can organisations tell whether entitlement governance is actually working?
A: Look for fewer unexplained overlaps, faster identification of redundant entitlements, and cleaner alignment between defined rules and actual assignments. If reviews keep finding the same structural issues, the governance model is not keeping pace with the environment.
Q: When should teams prioritise continuous optimisation over periodic access cleanup?
A: Prioritise continuous optimisation when identity, role, and application changes happen faster than scheduled reviews can absorb. In that environment, cleanup is too slow to prevent drift, so governance must react to live usage and structural signals instead of waiting for the next campaign.
Technical breakdown
Identity visibility turns IAM data into an operational control layer
Identity visibility is the ability to translate raw IAM records into patterns that reveal how identities, roles, and entitlements behave over time. In practice, that means highlighting outliers, relationships, and change, not just storing assignments. Time-based views matter because authorization is dynamic: the same entitlement can be appropriate in one context and risky in another. Without that layer, governance teams end up certifying snapshots rather than managing the live structure of access.
Practical implication: build identity visibility into governance workflows so reviews can evaluate behaviour, not just stored entitlements.
Hybrid RBAC and ABAC need one governance model
Most enterprises now run a mixed authorization model. RBAC gives structure through business roles, while ABAC adds contextual decision-making through attributes and signals. The technical problem is not choosing one or the other, but governing both without fragmenting policy logic. If they are managed in separate silos, teams lose consistency, cannot simulate changes cleanly, and struggle to explain why access exists. A single governance view is what makes hybrid authorization auditable and manageable.
Practical implication: govern RBAC and ABAC through one control framework so policy design, simulation, and approval stay aligned.
Continuous optimization is stronger than cleanup cycles
Access structures degrade through overlap, redundancy, and unused entitlements as organisations change. Cleanup cycles catch only what is visible at a point in time, while continuous optimisation looks for recurring structural drift. The important mechanism is feedback: usage, approval, and anomaly signals feed back into role and entitlement design. That shifts governance from episodic remediation to ongoing model correction, which is better suited to large, heterogeneous environments.
Practical implication: use continuous governance signals to refine roles and entitlements before drift becomes a recertification problem.
NHI Mgmt Group analysis
Identity visibility is now a governance requirement, not a reporting feature. When organisations cannot see how entitlements behave across systems, they cannot govern access with confidence. That problem is bigger than audit readiness because it affects every downstream decision about role design, entitlement risk, and recertification quality. The practical conclusion is that visibility must be treated as an operational control, not a dashboard accessory.
Hybrid RBAC and ABAC are not competing models, but they do create governance complexity. Many enterprises need both because business roles and contextual signals solve different problems. The challenge is consistency: if role logic and attribute logic live apart, teams lose explainability and introduce policy drift. Practitioners should expect hybrid authorization to increase the burden on governance design, not reduce it.
Continuous optimisation is the only realistic response to entitlement drift. Static cleanup programmes cannot keep pace with reorganisations, application sprawl, and changing business context. Governance structures need to move with the enterprise, or they become documentation of yesterday's access model. That means lifecycle processes, reviews, and approvals must be tied to live change signals if they are to stay relevant.
No-code governance lowers friction, but only if the underlying model is disciplined. Workflow automation can make review and approval processes easier to operate, yet automation cannot compensate for poor role definitions or inconsistent entitlement data. The lesson for identity leaders is that governance speed comes from clarity in the model first, then from automation layered on top.
Identity visibility creates the conditions for preventive compliance. The strongest governance posture is not detecting violations after assignment, but spotting structural issues before they become assignments. That shifts the programme toward earlier intervention, better business accountability, and lower remediation effort. For practitioners, the implication is to invest in decision quality upstream rather than relying on cleanup downstream.
From our research library:
- Nearly 60% of IT leaders cite restrictive cost and complexity as a weakness of legacy identity governance, according to the 2025 State of Identity Governance Report.
What this signals
Identity visibility is becoming the missing governance layer in hybrid authorization programmes. IAM teams that rely on static role catalogues will keep discovering that their control model describes yesterday's access, not today's. The practical shift is from reviewing entitlements to governing the behaviour of identities, roles, and attributes as a living system.
Hybrid RBAC-ABAC governance only works when policy logic stays explainable. Once contextual attributes are added, teams need a disciplined way to simulate, approve, and version decisions across both models. Without that discipline, authorization becomes harder to defend in audits and harder to operate at scale.
For practitioners
- Establish a single identity visibility model Map identities, roles, entitlements, and application relationships into one operating view so governance decisions are based on live structure rather than disconnected reports.
- Govern RBAC and ABAC together Define how role logic and attribute logic interact, then test whether policy changes remain explainable when both are applied to the same access path.
- Replace periodic cleanup with continuous optimisation Use usage, anomaly, and redundancy signals to flag roles or entitlements that no longer match current business structure.
- Tie approvals to governed workflows Route role changes, review comments, and versioned approvals through a controlled workflow so business stakeholders can participate without losing auditability.
- Strengthen data quality before scaling governance Validate completeness, consistency, and attribute harmonisation across source systems before expanding hybrid authorization models.
Key takeaways
- Many IAM programmes still lack a reliable view of how roles and entitlements behave across the enterprise, which weakens authorization governance.
- Hybrid RBAC and ABAC can support modern access needs, but only when both models are governed through a consistent control structure.
- Continuous optimisation is more effective than periodic cleanup because entitlement drift is ongoing, not episodic.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST CSF 2.0, CIS Controls v8, NIST SP 800-53 Rev 5 and NIST Zero Trust (SP 800-207) set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | The article focuses on governing entitlements and authorization behavior across the enterprise. |
| Recommendation — Apply PR.AA-05 to keep permissions, entitlements, and authorizations aligned with current business need. | ||
| CIS Controls v8 | CIS-5 — Account Management | Continuous governance of roles and entitlements is an account management concern across systems. |
| Recommendation — Use CIS-5 to standardize account and entitlement governance across changing environments. | ||
| NIST SP 800-53 Rev 5 | AC-6 — Least Privilege | Hybrid authorization and entitlement reduction both depend on enforcing least privilege at scale. |
| Recommendation — Apply AC-6 to remove excess entitlement and keep access bounded to job need. | ||
| NIST Zero Trust (SP 800-207) | Policy Decision Point — Policy Decision Point | The article's contextual authorization model aligns with centralized policy decisions for access. |
| Recommendation — Centralize policy decisions so contextual authorization stays explainable and consistent. | ||
Key terms
- Identity Visibility: Identity visibility is the ability to see which identities exist, what they can access, and how those access paths relate across systems. In NHI programmes, it means correlating service accounts, tokens, certificates, and agents into one operational view so governance decisions are based on evidence, not assumptions.
- Hybrid Authorization: Hybrid authorization is the use of role-based and attribute-based access controls together in one governance model. It lets organisations keep stable business roles while adding contextual policy logic for finer-grained decisions, but it also requires strong explainability so the two models do not drift into separate control silos.
- Continuous Optimization: Continuous optimization is the ongoing refinement of roles and entitlements based on live usage, overlap, redundancy, and change signals. It replaces occasional cleanup with a persistent governance loop that keeps the access model aligned with the enterprise.
- Preventive Compliance Check: A preventive compliance check evaluates an access request before it is approved or assigned, rather than discovering the problem later in a review. It is especially useful for separation-of-duties conflicts, risky entitlement combinations, and regulated workflows where correcting bad access after the fact is slower and costlier.
What's in the full article
Nexis's full article covers the operational detail this post intentionally leaves for the source:
- Identity visibility features such as grids, filtering, grouping, and drill-down views used to expose role and entitlement patterns
- Workflow design details for no-code lifecycle, review, and approval processes that reduce maintenance overhead
- Examples of preventive compliance checks, including separation-of-duties detection before assignment
- Data quality and connector considerations for harmonising legacy systems and attribute sets across heterogeneous environments
Deepen your knowledge
NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.
Published by the NHIMG editorial team on June 27, 2026.
Updated on October 7, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org