Identity governance’s last mile: what disconnected apps change

At a glance

What this is: This is an analysis of how disconnected applications create the last mile failure in identity governance, with Opnova arguing that banks and other large enterprises still lose recertification and provisioning coverage at the application edge.

Why it matters: It matters because IAM and IGA programmes fail where systems cannot be governed, leaving audit exposure, manual work, and inconsistent entitlement control across human and non-human access paths.

By the numbers:

• A bank can burn through three to five million dollars and still only cover 20 to 30 percent of its footprint.

Context

Identity governance is only as complete as the applications it can see and control. In many large enterprises, the hardest systems are the oldest ones: mainframes, terminal-based applications, and platforms with flat-file or CSV integration instead of modern APIs. When those systems sit outside the governance plane, recertification, provisioning, and audit evidence all become partial rather than reliable.

Opnova's article argues that this is not a new problem but a long-running coverage gap in IGA. The practical issue is not whether workflows can be automated in theory, but whether the governance programme reaches the disconnected applications that still carry business-critical entitlements and operational risk.

For banks and similarly complex environments, the last mile problem shows up as audit failure risk, manual service desk load, and slow onboarding. That makes disconnected applications an identity governance issue, not just an integration problem.

Key questions

Q: What breaks when applications are disconnected from IGA workflows?

A: Recertification, provisioning, and audit evidence break first because the governance system can no longer observe or enforce entitlements on those applications. Teams then fall back to manual tickets, one-off admin work, and inconsistent approvals, which creates control drift and slows onboarding. The fix is coverage, not just automation speed.

Q: Why do disconnected apps create so many audit problems?

A: Because auditors need proof that access was granted, reviewed, and revoked consistently, not just a statement that policy exists. Disconnected apps often force teams to assemble evidence after the fact from emails, screenshots, and export files. That is slow, fragile, and difficult to defend when controls are reviewed at scale.

Q: How should IAM teams prioritise disconnected application remediation?

A: Start with systems that are business critical, heavily privileged, or tied to quarterly access reviews, because those create the highest risk if they remain outside governance. Then sort by the cost of manual handling and the volume of unresolved tickets, so the first projects remove the most control debt.

Q: How can security teams tell whether automation is helping or harming identity governance?

A: Automation is helping when it reduces manual handling without creating duplicate records, orphaned entitlements, or unclear ownership. It is harming governance when integrations spread identity state across systems faster than teams can validate, audit, and correct it.

Technical breakdown

Why disconnected applications break identity governance coverage

Disconnected applications are systems that cannot be governed through standard IGA integrations because they lack modern interfaces such as APIs or SCIM. In the article's example, that includes AS/400-style mainframes and other legacy tools that only accept manual console actions, flat files, or CSV exports. IGA platforms can still manage the reachable core, but the long tail becomes an exception queue that never fully disappears. The result is not just operational friction. It is a structural blind spot where entitlements exist outside the normal recertification and provisioning lifecycle.

Practical implication: map every application that cannot be governed through your standard entitlement workflows and treat it as a coverage gap, not an integration detail.

How imitation learning changes connector build economics

The article describes imitation learning as recording how a human performs an administrative task and turning that sequence into a repeatable operating procedure. Instead of building a custom connector through traditional systems integration work, the model learns the interaction from screenshots and screen elements, then replays the process when conditions match the recorded path. This is different from browser automation because it is based on what the user sees and does on screen, not on a browser-only control layer. The technical shift is from hard-coded integration logic to behaviour capture and controlled replay.

Practical implication: evaluate whether legacy app coverage can be delivered through learned workflows before funding another long connector build.

Why the human-in-the-loop still matters for disconnected workflows

The article is explicit that AI does not remove the need for human judgment in these flows. The model can replay the happy path, but when a screen changes, a process stalls, or the expected state does not appear, the workflow needs human review and context to get back on track. That matters because disconnected applications often support exceptions, edge cases, and local administrative habits that are hard to normalise into one rigid control. The real design challenge is not full autonomy. It is controlled execution with escalation when the application path deviates from what was learned.

Practical implication: design a review and escalation path for exception handling so learned workflows do not become opaque automation.

NHI Mgmt Group analysis

Disconnected applications create governance debt, not just technical debt: identity programmes fail when a material portion of the application estate sits outside standard recertification and provisioning control. The article's core point is that long-tail coverage gaps persist because legacy platforms were never designed to participate in modern governance workflows. The implication is that IGA maturity should be measured by reach, not by the sophistication of the core platform.

Last mile identity governance is now a business continuity issue: when access to critical applications depends on manual tickets or one-off administrative handling, onboarding speed and audit readiness both suffer. That changes the conversation from integration convenience to control coverage and operational resilience. Practitioners should treat disconnected applications as a governance programme boundary condition, not an exception to be tolerated indefinitely.

Identity governance coverage has to be evaluated at the application edge: a platform can be strong in the centre and still fail where the business actually runs. This article sharpens a named concept: disconnected application governance gap, the point at which entitlement control stops because the system cannot be reached by the governance stack. Practitioners should use that gap as a programme metric, because what cannot be governed will eventually surface in audit, support, or access risk.

Automation only helps if it preserves control intent: record-and-replay approaches can reduce manual work, but they do not eliminate the governance requirement to know what changed, who approved it, and when human intervention is needed. That matters across human IAM and NHI-style lifecycle thinking alike, because every identity control depends on an authoritative record of access state. The practitioner takeaway is to automate coverage while keeping governance evidence intact.

Vendors that can handle disconnected systems are signalling where the market is headed: identity governance is moving from connector count as a feature metric to control reach as an operational metric. That shift validates a broader view of IGA maturity: a programme is only as complete as the applications that can actually be certified, provisioned, and reviewed. Practitioners should reassess whether their current architecture can govern the full estate or only the easy part.

From our research library:

• Nearly 60% of IT leaders cite restrictive cost and complexity as a weakness of legacy identity governance, according to the 2025 State of Identity Governance Report.

What this signals

Disconnected application governance gap: the real challenge is not whether IGA tools can automate a few workflows, but whether they can reach the systems where access decisions still happen manually. Programmes that cannot govern the long tail will keep absorbing service desk effort and audit exposure in parallel.

Identity teams should treat legacy applications as part of the governance perimeter, not as side projects for integration teams. If recertification and provisioning cannot touch a system, that system is outside the effective control model regardless of how strong the central IGA platform appears.

For practitioners

• Inventory disconnected application coverage Identify every application that still depends on manual admin actions, flat files, or CSV exports, and classify each one by business criticality and governance gap.
• Measure recertification failure points Track which entitlements cannot be certified on schedule because the application is unreachable from the IGA workflow, and use that list to prioritise remediation.
• Standardise learned workflow reviews Require identity engineers to review recorded workflows before production use, especially where the system path includes exceptions, screen changes, or human fallback.
• Separate automation from governance evidence Keep an authoritative record of who approved a workflow, what application state was observed, and when human intervention was needed so audit evidence remains defensible.

Key takeaways

• Disconnected applications remain a structural weak point in identity governance because they sit outside the normal certification and provisioning lifecycle.
• The article shows that manual handling at the long tail can consume large amounts of time and budget while still leaving coverage incomplete.
• Practitioners should measure IGA success by application reach and auditability, not by the sophistication of the central platform alone.

Key terms

• Disconnected Application: An application that is not integrated with the organisation's central identity and access stack. Access is often managed through shared passwords, manual approval, or local admins, which makes revocation, evidence, and ownership harder to enforce consistently across the application lifecycle.
• Last-Mile Integration Challenge: The final gap between identity policy and executable control in the target system. In practice, the challenge appears when the IGA platform can define the rule but cannot perform or evidence the action in a legacy application.
• Entitlement Coverage: Entitlement coverage is the extent to which an organisation can see, certify, and enforce access across its application estate. Weak coverage does not mean the programme is absent, only that parts of the environment remain outside reliable governance and audit evidence.
• Imitation Learning: A machine-learning approach that learns a workflow by observing how a human performs it. In governance use cases, the value is repeatability, but the control question is whether the learned path is reviewable, auditable, and bounded by explicit approval rules.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.