Identity is now a fabric: why seams, not logins, are the risk

At a glance

What this is: This is an Abnormal AI analysis of how identity security has shifted from directory-centric login control to a distributed fabric where federated trust, SaaS tokens, and NHIs create the real risk.

Why it matters: IAM, IGA, PAM, and NHI teams need to watch post-authentication behaviour across connected systems because hardening the front door does not reveal what identities do once trust is granted.

Context

Identity security now spans a fabric of federated trust rather than a single directory, which means the old model of one gate, one owner, and one control point no longer matches how access actually works. In that environment, the primary risk is not just who authenticates, but what identities can do after authentication across downstream systems, SaaS applications, and machine-driven access paths.

Non-human identities intensify that shift because service accounts, API tokens, and OAuth grants accumulate access in chains that are hard to trace back to a clear owner. When account ownership, token inheritance, and cross-platform behaviour are fragmented, governance breaks at the seams between systems rather than at the login screen.

Key questions

Q: How should security teams reduce identity drift in SaaS and NHI environments?

A: Start by reconciling approved access against current entitlements and ownership. Focus on orphaned accounts, stale vendor integrations, copied roles and temporary exceptions that never expired. The goal is not just cleanup. It is to make drift visible early enough that access can be corrected before it becomes normalised.

Q: What do IAM teams get wrong about stronger MFA and conditional access?

A: They often assume a stronger sign-in control will solve identity risk across the environment. In practice, MFA and conditional access protect the front door, but many attacks happen after authentication through legitimate tokens, delegated access, or anomalous application behaviour. That is where governance needs a second control layer.

Q: What are the signs that NHI sprawl is becoming a governance problem?

A: The warning signs are missing owners, chained grants, and access paths that cannot be explained from a single account record. When service accounts, API tokens, and OAuth grants accumulate reach through inheritance, the programme has lost effective privilege visibility even if every credential is individually valid.

Q: What should identity teams do when they cannot see what happens after sign-in?

A: They should add behavioural monitoring that compares each identity's normal actions with what it actually does across downstream systems. That gives IAM and NHI teams a way to detect abnormal use of legitimate access, which is where seam-level abuse often hides.

Technical breakdown

Federated trust turns identity into a distributed control plane

Modern identity stacks no longer terminate at a single directory or SSO gateway. A central IdP issues trust to downstream service providers, and each application enforces its own token handling, roles, and session boundaries. That means authentication is only the entry condition, not the whole control model. The architectural problem is that no single tool can see every trust edge, token exchange, and delegated permission path across the full fabric. Once access is federated, risk moves from perimeter checks to cross-domain visibility and governance.

Practical implication: treat federated trust paths as a separate control surface and map where visibility stops across IdP-to-SaaS handoffs.

NHI sprawl creates chained privilege that obscures ownership

Service accounts, API tokens, and OAuth grants behave like linked non-human identities, not isolated credentials. One grant can inherit another grant's access, which creates compounded reach even when no one explicitly approved the full chain. That is a governance problem, not just a secrets problem. When ownership is unknown for a large portion of NHIs, the issue is not merely inventory size. It is that delegated access becomes opaque, stale, and hard to recertify because the effective privilege is created by relationships between identities, not just by the identities themselves.

Practical implication: inventory NHI inheritance chains and make ownership a required attribute before you can govern effective privilege.

Behavioural visibility is the missing control across the fabric

Traditional identity controls focus on sign-in assurance, but many modern attacks happen after authentication succeeds. Behavioural AI changes the detection model by comparing what an identity normally touches with what it suddenly does across systems such as Workday or Salesforce. That matters because the signal often exists in routine activity drift, not in login anomalies. The deeper lesson is that identity security now needs continuous observation of actions, not just stronger checks at the front door. Post-authentication behaviour is where seam-level abuse becomes visible.

Practical implication: add behavioural baselines for post-login activity so unusual access patterns can be detected after trust is established.

NHI Mgmt Group analysis

Identity risk has moved from perimeter authentication to seam governance. The old directory model assumed one authoritative gate could define access risk. That assumption fails in a fabric of federated trust, SaaS services, and delegated tokens because the meaningful exposure emerges after authentication, where no single control owns the full path. Practitioners need to stop treating login hardening as the main identity security story.

NHI sprawl is now a governance problem, not just an inventory problem. Service accounts, API tokens, and OAuth grants do not simply increase count, they create inherited access relationships that are difficult to explain or recertify. When most organisations cannot identify the owners of half their NHIs, the issue is not visibility alone. It is that effective privilege is being created outside the governance model.

Behavioural visibility is the only durable control across a distributed identity fabric. Strong MFA and conditional access still matter, but they only address the entry point. The modern control gap is the inability to observe what authenticated identities do across systems, which means access control has to extend into runtime behaviour. That is where identity blast radius becomes measurable.

Identity seams are the new control boundary for IAM and NHI programmes. The central challenge is not whether each platform is secured in isolation, but whether the program can see the trust transitions between them. That makes cross-system identity correlation a core governance capability, not an optional analytics layer.

Seam-level governance will increasingly define identity maturity. Organisations that keep optimising login security while ignoring post-authentication activity will continue to miss the real abuse path. The next maturity step is to govern identity as a fabric with observable behaviour, traceable ownership, and visible delegation chains.

What this signals

Identity fabrics demand seam-level governance. Programmes that still centre reporting on login success rates will miss the control boundary that now matters most: the handoff between federated trust and downstream action. The programme shift is from authenticating identities to observing their cross-system behaviour.

Non-human identity ownership is now a prerequisite for effective recertification. If service accounts, API tokens, and OAuth grants cannot be tied to named owners and dependencies, access review becomes theatre rather than governance. The practical test is whether the team can explain why a non-human identity still exists and what it is allowed to reach.

Behavioural profiles are becoming the operational layer of identity security. A normal access pattern for one identity can become the most useful detection baseline for another, especially where SaaS and workflow actions are routine but not constant. That makes behavioural telemetry a governance input, not just a detection feed.

For practitioners

• Map federated trust seams Document every IdP-to-SaaS trust edge, including where short-lived tokens are issued and where local RBAC is enforced, so you can see which controls are isolated and which are correlated across the fabric.
• Inventory chained NHIs and owners Build an inventory that links service accounts, API tokens, and OAuth grants to named owners and upstream dependencies, then flag identities whose access is inherited from another grant.
• Baseline post-authentication behaviour Define normal action patterns for identities in systems such as Workday and Salesforce, then alert when an account performs tasks it has never performed before or at unusual points in the workflow.
• Correlate identity activity across platforms Use a central analytics layer to connect sign-in events with downstream actions so a granted session can be evaluated against what the identity actually did after authentication.

Key takeaways

• Identity risk now lives in the seams between federated systems, where access continues after the login event has passed.
• Non-human identities amplify that risk because chained grants and unclear ownership create hidden effective privilege across the fabric.
• The strongest control response is cross-platform behavioural visibility that shows what identities actually do after authentication.

Key terms

• Identity Fabric: An identity fabric is a connected control model that shares context across governance, privileged access, and access management. It is not a product category. The aim is to make identity decisions coherent across the full lifecycle so ownership, privilege, and enforcement reinforce each other.
• Federated Trust: A federated trust is the relationship that allows one identity system to vouch for a user or workload to another system. In ADFS-style models, the application accepts claims from the federation layer instead of authenticating directly. That reduces friction, but it also expands the number of components that must be trusted and defended.
• Non-Human Identity (NHI): A digital identity assigned to a non-human entity such as a software application, service account, API key, bot, machine, or AI agent that enables it to authenticate and interact with systems without direct human involvement. NHIs now outnumber human identities in most enterprises by 25 to 50 times.
• Behavior Baseline: A record of normal activity for a non-human identity, including typical consumers, resources, and actions over time. Baselines help security teams detect when an identity is being used in an unusual way and provide the context needed to enforce least privilege safely in dynamic environments.

Deepen your knowledge

NHI governance, identity lifecycle, and workload identity security are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.