TL;DR: Opal Security argues that identity lifecycle governance must move beyond onboarding and offboarding because permissions drift, accounts linger, and static rules fail across humans, service accounts, and AI agents. Continuous context-aware governance is becoming the real control plane for least privilege.
At a glance
What this is: This is an argument for continuous identity lifecycle governance, with Opal Security saying static IAM processes cannot keep pace with entitlement drift across humans, service accounts, and AI agents.
Why it matters: It matters because IAM and IGA teams need controls that update access as context changes, rather than relying on periodic reviews that leave orphaned access and privilege creep in place.
👉 Read Opal Security's analysis of continuous identity lifecycle governance across humans and machines
Context
Identity lifecycle management is the discipline of creating, updating, and revoking access as people and systems change. In this article, the problem is not whether onboarding and offboarding exist, but whether governance stays current when entitlements drift across humans, service accounts, and AI agents.
Traditional IAM tools tend to treat lifecycle as a set of periodic events. That model breaks when access changes continuously, because stale grants, orphaned accounts, and brittle policy logic expand the attack surface long before a review cycle catches up.
Key questions
Q: What breaks when identity programmes rely only on periodic governance reviews?
A: Periodic reviews often miss the state of access between certification cycles. That creates blind spots in privileged access, orphaned accounts, and access drift across systems that change quickly. Without continuous visibility, teams can approve clean reports while real access remains excessive, stale, or disconnected from business need.
Q: When should teams prioritise continuous access updates over role cleanup?
A: Teams should prioritise continuous access updates when downstream systems inherit access automatically or when a single role change can ripple across multiple applications. In those environments, cleanup alone is too late because the real risk is the delay between a business change and the enforcement of the new access state.
Q: What are the signs that lifecycle governance is failing?
A: Look for redundant entitlements, orphaned accounts, unexpected bulk changes, and access paths that no one can explain end to end. If inventory views cannot show where a grant came from, or if leavers still retain active access in connected systems, the lifecycle control is already failing.
Q: Why do non-human identities make lifecycle governance harder?
A: Non-human identities often outlive the people and projects that created them, and they are frequently reused across systems. That makes ownership, purpose, and revocation harder to prove. Teams need the same lifecycle discipline for service accounts and tokens as for human access, or access drift becomes routine.
Technical breakdown
Why static lifecycle rules fail under changing context
Lifecycle governance breaks when access is treated as a one-time assignment instead of a living state. Static roles and periodic reviews can create a false sense of control while entitlements drift through HR, IDP, and downstream application logic. The result is accumulation of permissions that no longer match the current business context, especially when the same identity changes role, system, or approval path. Continuous governance uses context-enriched policy to recalculate access as attributes change, rather than waiting for a later certification cycle.
Practical implication: replace event-only lifecycle checks with context-driven entitlement updates that can revoke and reassign access as soon as the underlying facts change.
How account-layer automation changes joiner, mover, and leaver control
Joiner, mover, and leaver workflows become materially different when the account itself is governed continuously. Account creation can be deferred until access is approved and needed, movers can trigger entitlement recalculation when attributes change, and leavers can cause both entitlement revocation and account deprovisioning. This shifts lifecycle control from manual ticket handling to policy-driven state transitions. The technical issue is not just provisioning speed, but making sure the account layer and the entitlement layer stay synchronised across connected systems.
Practical implication: align account provisioning, entitlement updates, and deprovisioning so no system keeps an identity alive after its business state has changed.
Why access-path transparency matters for lifecycle governance
Access lifecycle failures are often hidden by indirect grants, inherited groups, and overlapping policies. Without a clear inventory of how each entitlement was granted, teams cannot tell whether access came directly, through a group, or through a codified rule. That opacity makes remediation slow and makes policy drift harder to detect. Transparency about grant source turns lifecycle management into an explainable control rather than a black box, which is essential when multiple systems can add or preserve access without a single owner seeing the full path.
Practical implication: maintain source-of-grant visibility for every entitlement so orphaned access and overlapping policies can be traced and removed quickly.
Threat narrative
Attacker objective: The objective is to exploit access that outlives its legitimate business purpose so the attacker can move through systems with less resistance.
- Entry begins when an identity changes state without corresponding access removal, leaving stale entitlements or dormant accounts in place.
- Credential or account reuse then gives an attacker a ready-made path through orphaned access, especially where deprovisioning is incomplete or delayed.
- Escalation follows through overprovisioned permissions, inherited access, or brittle policy logic that preserves more access than the current role requires.
- Impact is expanded attack surface, slower containment, and a longer window in which compromised or dormant identities can be abused.
Breaches seen in the wild
- Coupang Signing Key Breach: Unrevoked signing key credentials expose 33.7 million records after employee offboarding failure at Coupang.
- Salesloft OAuth token breach: hackers stole OAuth tokens to access Salesforce data via Salesloft.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 150+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Continuous lifecycle governance is now an identity control plane, not an administrative convenience. The article correctly frames identity lifecycle as a live governance problem rather than a joiner-mover-leaver clerical task. When access can change every time a role, attribute, or system state changes, the control has to move from periodic review to continuous entitlement enforcement. For practitioners, that means lifecycle design now sits at the centre of least-privilege governance.
Brittle IDP logic creates governance debt that accumulates across all identity types. The article points to a familiar failure pattern: manual processes and rigid rules produce redundant entitlements, orphaned accounts, and access paths no one can easily explain. That is not just operational inefficiency. It is a structural loss of control over who or what still has access, and it affects humans, service accounts, and AI agents alike. The practical implication is that policy logic itself becomes a governance surface that must be managed.
Lifecycle visibility is the difference between revocation and guesswork. A system that cannot show how an entitlement was granted cannot reliably tell whether it should still exist. That matters because overlapping group membership, application-level roles, and downstream synchronisation can keep privileges alive long after ownership has shifted. For IAM and IGA teams, the decisive issue is explainability: if access paths are opaque, revocation becomes partial, slow, and easy to miss.
Unified lifecycle governance for humans and non-humans is becoming the baseline expectation. The article’s broader point is that contractors, service accounts, and AI agents cannot be left outside the same governance discipline simply because they move differently through the environment. Their lifecycles differ, but the control problem is shared: access must be current, attributable, and revocable. Practitioners should treat lifecycle governance as one discipline applied to multiple identity types, not three separate programmes.
Orphaned access is the named concept that best captures this risk. Accounts and entitlements that remain after the business need has ended create a reusable foothold for abuse, whether the identity is human or machine. The governance failure is not merely late cleanup. It is access that continues without an accountable owner or an active purpose. The implication is that offboarding quality now directly defines attack surface quality.
From our research library:
- 80% of identity breaches involved compromised non-human identities such as service accounts and API keys, according to the Ultimate Guide to NHIs.
- Only 5.7% of organisations have full visibility into their service accounts, according to the Ultimate Guide to NHIs.
- Read next: Ultimate Guide to NHIs
What this signals
Orphaned access is the practical symptom of lifecycle governance debt. When access is granted once and then left to drift, revocation becomes a cleanup exercise instead of a control. Security teams should expect the highest-risk gaps to appear where entitlement logic, downstream synchronisation, and manual offboarding meet.
Access-path transparency is the difference between a governance programme that can remediate and one that can only review. If teams cannot see whether access came directly, through a group, or by policy, they cannot prove that removal was complete.
The same lifecycle model now has to govern humans, service accounts, and AI agents, but each identity type creates a different failure mode. That makes continuous governance a programme design issue, not a single workflow fix.
For practitioners
- Define continuous entitlement governance Treat access as a state that must be recalculated when role, attribute, or system context changes, not only during periodic reviews.
- Map account and entitlement ownership Maintain a clear record of who approves, who grants, and who can revoke each access path across HR, IDP, and downstream apps.
- Automate leaver revocation end to end Remove both entitlements and underlying accounts when the business relationship ends, including connected SaaS systems and identity providers.
- Surface overlapping grant sources Use inventory views to identify when a user inherits the same access through multiple policies, groups, or application roles.
- Pause high-impact policy changes for review Block unexpected bulk entitlement changes so a bad rule cannot cascade into widespread overprovisioning before anyone investigates.
Key takeaways
- Lifecycle governance fails when access changes are treated as isolated events rather than a continuous state that must stay aligned with business context.
- The article ties that failure to orphaned accounts, brittle rules, and lingering entitlements that widen the attack surface.
- The control lesson is to unify entitlement updates, deprovisioning, and grant-path visibility so access can be revoked cleanly when it is no longer needed.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 addresses the attack and risk surface, while NIST CSF 2.0, NIST SP 800-53 Rev 5 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-01 — Improper Offboarding | The article centres on leaving accounts active after the business need ends. |
| NHI-05 — Overprivileged NHI | The article describes entitlement drift and access that exceeds current need. | |
| NHI-09 — NHI Reuse | The same identity and account patterns recur across humans, service accounts, and AI agents. | |
| Recommendation — Apply NHI-01 controls to ensure identities and entitlements are removed when the lifecycle ends. Use NHI-05 to continuously reduce excess access as roles and context change. Track reused identity patterns so lifecycle governance can be applied consistently across identity types. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | Continuous entitlement governance maps directly to access permission control. |
| Recommendation — Manage permissions and authorisations as dynamic states rather than static assignments. | ||
| NIST SP 800-53 Rev 5 | AC-2 — Account Management | The article focuses on creating, updating, and disabling accounts across the lifecycle. |
| AC-6 — Least Privilege | The article’s core governance goal is keeping access aligned to current need. | |
| Recommendation — Automate account creation, modification, and disabling to match lifecycle changes. Limit active permissions to what the current role or task actually requires. | ||
| CIS Controls v8 | CIS-5 — Account Management | Lifecycle drift and orphaned access are account-management failures. |
| Recommendation — Use account management controls to find and remove stale or dormant access. | ||
Key terms
- Continuous Lifecycle Governance: Continuous lifecycle governance is the ongoing practice of identifying, tracking, and managing the support status of assets across an environment. It combines inventory, decommissioning, replacement planning, and recurring discovery so unsupported systems do not become hidden risk. The model turns lifecycle management into a standing operational control rather than an occasional review.
- Orphaned Access: Orphaned access is credentialed access that still works even though no clear business owner can justify or manage it. It usually appears after system changes, reorganisations, or integrations, and it is especially dangerous because it can remain active long after the original purpose has disappeared.
- Access-Path Transparency: Access-path transparency is the ability to see exactly how an entitlement was granted, whether directly, through a group, or through policy inheritance. It is essential for lifecycle governance because teams cannot reliably revoke, certify, or explain access if the source of the grant is hidden.
- Entitlement Drift: Entitlement drift is the slow accumulation of permissions that no longer match the original purpose, role, or workload. In cloud-native and NHI-heavy environments, it usually happens because access changes faster than review cycles, leaving organizations with more privilege than they intended.
What's in the full article
Opal Security's full article covers the operational detail this post intentionally leaves for the source:
- How Access Rules apply attribute-enriched policies to grant, update, and revoke entitlements as context changes
- How User Account Provisioning and User Account Deprovisioning work across connected applications and identity systems
- How the Risk Center flags risky policies, anomalies, and misaligned accounts before they spread
- How the platform handles bulk-change guardrails to pause unexpected high-impact updates
Deepen your knowledge
NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.
Published by the NHIMG editorial team on June 23, 2026.
Updated on October 7, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org