TL;DR: Identity programmes can process millions of accounts and still leave critical applications, entitlements and non-human identities outside effective governance, according to SafePaaS. The real measure of scale is time to governance coverage across business boundaries, because administration that outpaces policy is not control.
At a glance
What this is: This analysis says identity scale is a governance coverage problem, not a headcount problem, because organisations can add identities faster than they can extend auditable policy across systems and business boundaries.
Why it matters: IAM, IGA and compliance teams need a coverage metric that includes applications, entitlements, non-human identities and organisational context, or they will confuse bigger directories with better control.
Context
Identity scale means how far governance reaches across the systems, business units and identity types that can grant access, change access or hide access risk. In complex enterprises, the problem is not usually the number of identities stored in a platform, but the number of places where policy, entitlement detail and evidence are missing.
This article frames that gap as a governance coverage issue for human and non-human identities. The practical question is whether identity controls can expand fast enough across acquisitions, ERP instances, SaaS platforms, service accounts and AI agents without forcing a redesign every time the business changes.
Key questions
Q: How do I tell whether identity governance is scaling or just administration?
A: Look at coverage, not account volume. If new systems, entitlements and business entities are still being governed through spreadsheets, tickets or local exceptions, administration is scaling faster than governance. A credible programme can show that material access is under consistent policy across the estate, not only inside the systems it already knows well.
Q: Why do large identity platforms still leave access risk unresolved?
A: Because platform size does not guarantee entitlement depth or business context. Many tools can hold millions of accounts, but they still fail to show what those accounts can actually do across applications, legal entities and workflows. Governance breaks when review logic stops at roles and never reaches effective access.
Q: What breaks when non-human identities are left out of governance?
A: When non-human identities are left out, ownership becomes unclear, credentials stay active too long, and audit cannot verify who approved the access or why it still exists. That creates a blind spot for service accounts, bots, and AI agents that often hold powerful permissions but rarely get the same lifecycle scrutiny as people.
Q: How should teams prioritise governance after an acquisition or major application change?
A: Start with the applications and entitlements that can affect financial reporting, sensitive data or critical operations. Those areas define the real risk surface, and they should move into policy before lower-value systems. The goal is to reduce time to coverage, not to rebuild the identity model from scratch.
Technical breakdown
Why identity volume is not the same as governance coverage
Identity platforms can scale in account count while still failing to expose the entitlement detail that actually matters for access decisions. A user role may exist in the system of record, but the real risk sits in the privileges, data actions and cross-system combinations hidden behind that label. In large enterprises, the limiting factor is not storage or workflow throughput; it is whether governance can see and evaluate material access everywhere the business operates.
Practical implication: Measure coverage at the entitlement and application layer, not by the raw number of identities enrolled.
How business boundaries change the meaning of access
Access that is acceptable in one legal entity, geography or operating unit may be inappropriate in another, even when the same role name appears in both places. That means global identity administration is not enough. Governance has to understand organisational context so that segregation of duties, approval logic and certification outcomes reflect the business structure, not just the directory structure.
Practical implication: Map access policies to business context before treating role names as portable across the enterprise.
Why non-human identities expand the governance problem
Service accounts, bots, API credentials and AI agents now sit alongside employees and contractors as first-class access holders. They may be created faster, changed more often and retired less reliably than human identities, yet they can still move data, trigger transactions and touch sensitive systems. Once these identities are in scope, identity scale becomes a lifecycle and ownership problem as much as an access problem.
Practical implication: Bring non-human identities into the same governance model used for people, including ownership, review and retirement.
NHI Mgmt Group analysis
Identity scale is fundamentally a governance coverage problem. Enterprises do not fail because they cannot store enough accounts; they fail because material access remains outside auditable policy. Once that happens, headcount growth is a distraction, because the real issue is whether the organisation can govern every important entitlement across every material application.
Application depth matters more than identity volume. A large identity population is not a control objective if reviewers cannot see the privileges, data access and business actions attached to those identities. The decisive question is whether policy can operate at entitlement level across ERP, SaaS, legacy and acquired systems.
Non-human identities make coverage the new scale metric. Service accounts, bots and AI agents do not wait for lifecycle comfort, and they do not map neatly to human governance assumptions. Their growth turns identity scale into a question of ownership, certification and retirement across machine-speed actors as well as people.
Time to governance coverage is the more useful scale measure. If it takes months to bring an acquired or previously unmanaged system into scope, risk accumulates in the gap regardless of how well the core IAM platform performs. The mature programme is the one that can extend policy quickly without rebuilding its control model each time the business changes.
Federated control planes will define the next phase of identity governance. The market is moving toward architectures that keep existing IAM and ERP investments while layering consistent policy and evidence above them. Practitioners should judge these models by how quickly they close real coverage gaps, not by how many identities they can count.
From our research library:
- NHIs outnumber human identities by 25x to 50x in modern enterprises, according to the Ultimate Guide to NHIs.
- Read next: NHI Lifecycle Management Guide
What this signals
Coverage will replace headcount as the identity scale metric. Large enterprises already have enough identity volume to expose the weakness in account-centric thinking, and the harder problem is now whether policy reaches every place where access can create risk. The programmes that win are the ones that can extend governance across applications, entities and non-human identities without lengthy re-platforming.
Governance latency is the hidden control gap. If it takes too long to bring an acquired system, service account or new business unit under policy, the organisation is carrying unmanaged access during the exact period when change risk is highest. That latency is where audit findings, segregation-of-duties issues and unowned machine identities tend to accumulate.
For practitioners
- Measure governance coverage, not just identity count Track what proportion of material applications, entitlements and identity types are actually under consistent policy and evidence, then use that number as the scale metric for the programme.
- Map entitlement depth across critical applications Require reviewers to see the privileges, data access and cross-system combinations behind each role so approvals are based on effective access rather than role labels alone.
- Bring non-human identities into the review model Extend ownership, certification and retirement processes to service accounts, bots, API credentials and AI agents so machine identities are not left outside the governance scope.
- Assess time to coverage after mergers and change events Measure how long it takes to bring acquired applications and locally managed systems under policy, because long onboarding timelines are where unmanaged access accumulates.
Key takeaways
- Identity scale should be judged by how much material access is governed, not by how many accounts a platform can store.
- The hardest scaling problems are entitlement depth, business context and coverage across non-human identities, not identity volume alone.
- A stronger programme shortens the time between business change and auditable governance coverage.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 and MITRE ATT&CK address the attack and risk surface, while NIST CSF 2.0, CIS Controls v8 and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-05 — Overprivileged NHI | The article centers on governing non-human identities that can remain outside effective scope. |
| Recommendation — Map machine identities to NHI-05 and verify their effective access is governed at entitlement level. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | The core problem is incomplete control over entitlements and authorization scope across systems. |
| Recommendation — Apply PR.AA-05 to ensure entitlements are visible, reviewed and controlled across material applications. | ||
| CIS Controls v8 | CIS-5 — Account Management | The article discusses lifecycle and ownership gaps across human and non-human accounts. |
| Recommendation — Use CIS-5 to inventory, own and review all accounts that can affect critical access. | ||
| NIST SP 800-53 Rev 5 | IA-5 — Authenticator Management | Identity scale depends on managing credentials and access artifacts across people and machines. |
| Recommendation — Apply IA-5 to govern credential lifecycle wherever non-human identities can reach sensitive systems. | ||
| MITRE ATT&CK | TA0006;TA0008 — Credential Access; Lateral Movement | Unchecked machine identities increase opportunities for credential abuse and movement across systems. |
| Recommendation — Map unmanaged identities to TA0006 and TA0008 to prioritize access paths that expand blast radius. | ||
Key terms
- Governance Coverage: The proportion of material access, applications and identity types that are actually governed by policy, review and evidence. In identity programmes, coverage is more important than raw account volume because risk lives where access is unreviewed or unmanaged.
- Time To Governance Coverage: Time to governance coverage is the interval between a new system, entitlement or identity type appearing and that access being brought under policy and review. In mature programmes, the interval is short enough that business change does not create a prolonged blind spot.
- Entitlement Depth: Entitlement depth is the level of detail an identity platform can report and govern beyond simple app access. It includes roles, privileges, delegated permissions and inherited access, which are the elements that determine real blast radius and audit quality.
- Federated identity governance: Federated identity governance distributes control across platforms and business units while keeping policy, evidence, and accountability aligned. It is used when identities and permissions are managed in multiple systems, but the organisation still needs one risk view and one governance standard.
Deepen your knowledge
NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.
Published by the NHIMG editorial team on August 15, 2026.
Updated on October 6, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org