TL;DR: As organisations shift to remote work, expand contractor access, and rely more on bots using service accounts, static entitlements and manual requests no longer keep pace with changing access patterns, according to SailPoint. The governance problem is now about real-time identity control across workforce, machine, and data access, not separate compliance checkpoints.
At a glance
What this is: This SailPoint blog argues that identity security now has to govern remote workers, contractors, bots and sprawling data access together because access patterns change too quickly for static controls.
Why it matters: IAM, IGA and PAM teams need to treat workforce, machine and data access as one governance problem, or they will miss the real-time entitlement changes that create risk.
By the numbers:
- SailPoint says it is seeing 87% growth in access requested and more than 50% growth in monthly active users year over year.
- SailPoint estimates that 80-90% of enterprise data is now outside the traditional confines of enterprise applications.
Context
Identity security now has to deal with access that changes faster than annual reviews or static entitlement models can track. In this article, SailPoint describes a governance problem created by remote work, contractor access, bot-driven service accounts and data spread across file stores and SaaS platforms.
The underlying issue is not just more users or more systems. It is that workforce, machine and data access now shift in real time based on role, geography, data restrictions and time of day, which makes manual administration and binary privileged-versus-standard models insufficient.
For IAM and IGA programmes, that means identity security has become a continuous control problem across human and non-human identities rather than a checkpoint exercise at request or recertification time.
Key questions
A: Use context-aware policy instead of fixed entitlements. Access decisions should reflect role, location, time and data restrictions at the moment of use, then be re-evaluated as those conditions change. That reduces reliance on manual requests and makes identity governance responsive to actual operating conditions.
Q: Why do service accounts and bots create more governance risk than many human accounts?
A: Service accounts and bots create more governance risk because they are often granted privileges for speed and left in place after the original use case changes. They can multiply quickly across integrations and workflows, making ownership, review, and deprovisioning harder to maintain. When lifecycle controls are weak, orphaned access becomes a standing risk surface.
Q: What breaks when identity governance tools cannot keep up with entitlement growth?
A: When governance tooling cannot keep pace, alert queues stay overloaded, provisioning requests backlog, and access anomalies go unresolved. Teams begin operating on assumptions rather than evidence. The control still exists on paper, but decisions are delayed, inconsistent, and increasingly detached from the actual risk in the environment.
Q: How should IAM teams respond when data sits outside traditional applications?
A: They should tie identity policy to the data estate, not just to application inventories. That means mapping where sensitive data lives, who can reach it and what restrictions apply, then governing access across file stores, SaaS repositories and data lakes as one control surface.
Technical breakdown
Why static entitlements fail when access changes in real time
Static entitlements assume that access can be defined once and then reviewed later. That model breaks when a user, contractor or service account needs different rights based on context such as location, data restrictions or time of day. In practice, the access decision is no longer a single provisioning event but a sequence of governed decisions tied to operational conditions. That is why manual requests and periodic attestation struggle to keep pace. The control problem is not merely volume. It is that identity state is now dynamic, and governance has to follow that dynamic state rather than a fixed catalogue of permissions.
Practical implication: model entitlement decisions as conditional and time-sensitive, not as one-time assignments.
How service accounts and bots reshape identity governance
Bots using service accounts are described here as a major part of enterprise access, which turns a machine credential into a governance object rather than just an IT artifact. A service account can represent machine-to-machine activity, but it can also embody delegated business action, data access and privilege escalation paths. That means identity teams have to treat service accounts as first-class identities with ownership, scoping, lifecycle and review requirements. The challenge is not only authentication. It is making sure the account’s effective authority still matches the process it supports as workloads, integrations and data flows change.
Practical implication: govern service accounts with the same lifecycle discipline you apply to human access.
Why data sprawl changes the access control boundary
The article’s data point is that enterprise data has moved outside traditional application boundaries into unstructured stores, data lakes and SaaS repositories. Once data is spread across many repositories, identity governance can no longer rely on application-centric access models alone. Access must be evaluated against the data itself, the consumer’s role and the regulatory restrictions tied to use of that data. This shifts identity security toward a closer relationship with data governance and access policy enforcement. The control boundary is now broader than the app, because the risk sits in the data estate as much as in the account that reaches it.
Practical implication: connect identity governance to data location, sensitivity and usage rules rather than to application lists alone.
Breaches seen in the wild
- Coupang Signing Key Breach: Unrevoked signing key credentials expose 33.7 million records after employee offboarding failure at Coupang.
Read our 52 NHI Breaches Analysis report for a comprehensive view of breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Static entitlement governance no longer matches modern identity behaviour: SailPoint’s core point is that access is now conditional, contextual and fast-moving across humans and machines. That makes periodic review a poor fit for environments where privilege changes in response to geography, posture and data restrictions. The practitioner conclusion is that governance must move closer to issuance and runtime policy.
Service accounts have become governance subjects, not background plumbing: When bots account for most of enterprise access in some environments, the old divide between privileged and non-privileged identity stops being operationally useful. Service accounts now carry business authority, data reach and escalation potential, so lifecycle and ownership discipline matter as much as technical authentication. The practitioner conclusion is that NHI oversight belongs inside identity governance, not beside it.
Data sprawl creates an identity blast radius problem: Once most enterprise data sits outside traditional applications, access control has to account for where data lives and how it is consumed. That widens the blast radius of a mis-scoped identity because one entitlement can now reach many repositories and regulatory contexts. The practitioner conclusion is that identity security and data governance now have to be designed together.
Access review programmes were built for stable identity states: The assumption that access stays put long enough to be certified was workable when people, systems and data changed more slowly. That assumption weakens when access is re-evaluated in real time, across remote work, contractor expansion and automated service accounts. The practitioner conclusion is that review cadences alone no longer define governance quality.
Runtime identity governance: The article points to a programme shape where identity decisions must follow context, not just records. That is the real shift from compliance attestation to continuous control, and it affects human IAM, NHI governance and data access together. The practitioner conclusion is that teams should judge their maturity by how quickly they can govern change, not how neatly they can document it.
What this signals
Runtime identity governance: Identity security programmes need to move from reviewing access after the fact to governing it as conditions change. That matters most where remote workers, contractors and service accounts all reach the same data estate through different operating contexts.
The strongest signal in this article is that workforce, NHI and data governance can no longer be managed in separate queues. Practitioners should expect pressure to collapse those queues into one access model that can evaluate context, not just entitlement records.
For practitioners
- Define context-aware access policies Map the conditions that change access, including role, geography, time of day and data-use restrictions, then make those conditions part of access decisions rather than exception handling.
- Treat service accounts as governed identities Assign named ownership, scoped purpose, review cadence and lifecycle controls to bots and service accounts so their effective authority can be challenged when business processes change.
- Rework access reviews for dynamic entitlements Shift recertification from a static checklist to a process that validates whether access still matches current context, data sensitivity and operating conditions.
- Link identity controls to data access paths Inventory where sensitive data lives across file stores and SaaS repositories, then align identity policy to those paths instead of only to application ownership.
Key takeaways
- Remote work, contractor growth and bot-driven access have made static entitlement models too slow for modern identity governance.
- The article says enterprise data is now so distributed that access control has to account for many repositories, not just applications.
- Identity teams need to shift from periodic attestation to continuous, context-aware control across human and non-human identities.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 addresses the attack and risk surface, while NIST CSF 2.0, NIST SP 800-53 Rev 5 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-05 — Overprivileged NHI | Service accounts and bots are described as carrying broad enterprise access that outgrows simple human-style governance. |
| NHI-07 — Long-Lived Secrets | Static entitlements and persistent access models are the core governance problem in the article. | |
| Recommendation — Apply NHI-05 to scope machine identities by purpose and limit their effective access to current business need. Review NHI-07 exposures where access persists beyond the context that justified it and shorten credential lifetimes. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | The article is fundamentally about keeping permissions aligned to changing context and business need. |
| Recommendation — Use PR.AA-05 to continuously align entitlements with role, location and data-use conditions. | ||
| NIST SP 800-53 Rev 5 | AC-6 — Least Privilege | The post argues that broad or stale access no longer reflects how modern work and automation operate. |
| Recommendation — Enforce AC-6 so human and machine identities only hold the minimum access required for the current task. | ||
| CIS Controls v8 | CIS-5 — Account Management | The article centres on managing workforce and service-account growth across a changing access estate. |
| Recommendation — Use CIS-5 to inventory, own and regularly review all active accounts, including bots and service accounts. | ||
Key terms
- Context-Aware Access Review: A decision process that evaluates access requests using request intent, existing entitlements, resource sensitivity, and operational evidence. In identity programmes, it reduces blind approvals by forcing reviewers or automation to weigh the real circumstances behind the request, not just the ticket itself.
- Service Account Governance: The set of policies and operational controls used to manage non-human accounts across their full lifecycle. It covers provisioning, access scope, rotation, revocation, and review, with the goal of preventing long-lived credentials from becoming persistent paths into critical systems.
- Identity Blast Radius: The amount of damage a compromised identity can cause across systems, data, and infrastructure. In NHI environments, it is shaped by permissions, network reach, and administrative capability rather than by the credential alone. Reducing blast radius is a containment strategy that limits lateral movement and data exposure.
- Runtime identity governance: Runtime identity governance is the discipline of checking identity behaviour while access is being used, not just when it is granted or reviewed. It combines telemetry, policy comparison, and response so organisations can detect when access drifts from intent across distributed systems.
Deepen your knowledge
NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.
Published by the NHIMG editorial team on June 25, 2026.
Updated on October 6, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org