TL;DR: No single IGA, PAM, or IdP can serve as a complete identity system of record because each only knows the identities and credentials inside its own coverage boundary, according to Hydden. That matters because unmanaged accounts, static keys, and unvaulted privilege remain invisible until governance starts from a neutral cross-system record.
At a glance
What this is: This is an analysis of why identity system of record claims break down when governance, vault, and federation tools only see their own silos.
Why it matters: IAM and PAM teams need a cross-system record because coverage gaps are not just reporting gaps, they are blind spots for audit, recertification, and privileged access control.
Context
Identity system of record is a governance problem, not a product claim. The core issue is that each identity tool can only describe the identities, accounts, and credentials it can actually see and manage.
In practice, that means IGA, PAM, and IdP platforms each produce accurate but partial records. The article's central point is that a neutral record has to sit across those boundaries if teams want to understand what is missing, not just what is covered.
Key questions
Q: Why do identity tools fail as a complete system of record?
A: They fail because each tool only knows the identities and credentials within its own coverage boundary. IGA sees connected applications, PAM sees vaulted credentials, and the IdP sees federated logins, but none of them can inventory everything on their own. A complete record has to correlate all of those sources outside any single control plane.
Q: What happens when privileged accounts exist outside the vault?
A: They remain outside privileged access governance altogether. The vault can only report on credentials it manages, so unvaulted local accounts, static passwords, and cloud roles created outside the workflow can persist without checkout history, rotation evidence, or recertification visibility. That creates a blind spot for both audit and risk management.
Q: How can teams tell whether their identity coverage is actually complete?
A: They should compare the identities visible in each source system against a neutral, consolidated inventory. If the IGA, PAM, and IdP each describe different parts of the estate, completeness has not been achieved. Coverage is only credible when the gaps between those views are known and tracked.
Q: What should security teams do when one identity tool cannot explain the whole estate?
A: They should stop treating any single platform as the authoritative record and move to a neutral correlation layer. That layer should preserve history from HR, governance, vault, and authentication systems so reviewers can make decisions with full context rather than partial tool-specific records.
Technical breakdown
Why tool-bound coverage creates partial identity records
An identity system of record is only as complete as the system's reach. IGA inventory is bounded by connectors, PAM is bounded by vaulted credentials, and an IdP is bounded by federated authentication. That means each platform can be authoritative within its own domain while still being blind to local accounts, static keys, unmanaged service credentials, or applications that authenticate elsewhere. The technical failure is not bad data inside the tool. It is the absence of a shared object model that can reconcile identities across systems that name and store them differently.
Practical implication: treat coverage boundaries as a design constraint and map what each source can never see, not just what it reports.
Why identity history fragments across IGA, PAM, and IdP logs
Each platform records only its own history. IGA stores approvals, recertifications, and entitlement changes. PAM stores checkouts, rotations, and sessions for vaulted credentials. An IdP stores federated authentication events. None of those histories automatically capture a local account appearing on a host, a static password on an application, or a service principal created outside the governed workflow. Without a neutral record that consolidates those events, reviewers see separate timelines instead of a single identity narrative. That makes drift, shadow access, and missing onboarding or offboarding context much harder to identify.
Practical implication: centralise identity event history outside the control plane that created it so reviewers can see lifecycle changes across the whole estate.
Why a neutral system of record must sit outside the control tools
A neutral record is not another authority over access. It is a cross-system ledger that accepts inputs from IGA, PAM, HR, the IdP, and unmanaged systems without forcing them into one vendor's data model. Because it belongs to none of those tools, it can hold identities that no single platform recognises in full, such as a Unix local account, an ERP login, and an Entra account for the same person or workload. The architectural purpose is correlation, not control. Once correlation exists, access decisions and vaulting actions can be made against a more complete picture.
Practical implication: design the record to correlate identities first, then let governance and privilege tools act on the unified view.
Breaches seen in the wild
- Azure Key Vault Contributor escalation 2024: Datadog found Azure Key Vault Contributor could add itself to access policies and read every secret, key and certificate in a vault.
- OneLogin API flaw (CVE-2025-59363): A OneLogin API flaw exposed OIDC client secrets to anyone with an API key, including vendors (CVE-2025-59363); fixed with no customer impact.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Tool-bound identity records are structurally incomplete by design: an identity platform cannot be the system of record for assets it cannot reach. IGA sees connected applications, PAM sees vaulted credentials, and the IdP sees federated identities, but none of them can describe the full estate on its own. The implication is that governance programmes built on single-tool completeness assumptions will keep missing unmanaged access.
Coverage boundaries are the real governance boundary: the article exposes a named concept we would call the identity coverage boundary, the point at which a vendor's object model stops and the rest of the estate becomes invisible. That boundary matters more than the tool brand because unmanaged accounts, static keys, and unvaulted privilege typically live beyond it. Practitioners should treat coverage as a first-class control issue, not a reporting nuisance.
Identity history must be assembled outside the source systems: recertification, checkout logs, and federation events are all partial histories with different clocks and different scopes. When those records are merged into a neutral system, reviewers can see when an account appears outside the last campaign or when privileged access exists without vault history. The discipline shifts from asking whether a tool is authoritative to asking whether the programme can reconstruct identity lineage end to end.
System of record claims fail whenever control and completeness are confused: a vault can be authoritative for vaulted secrets without being complete for privileged access, and an IdP can be authoritative for federated logins without being complete for standing access. That distinction is the governance fault line this article exposes. The practical conclusion is that identity governance needs a record that reconciles scope before any tool can claim coverage.
Neutrality is a data architecture requirement, not a philosophical one: if the record lives inside IGA, PAM, or the IdP, it inherits that platform's naming rules and blind spots. A neutral record can accept mismatched identifiers and preserve context across human, machine, and privileged access sources. Practitioners should insist on cross-system correlation as a prerequisite for trustworthy identity decisions.
From our research library:
- Only 44% of organisations are currently using a dedicated secrets management system, according to the 2024 State of Secrets Management Survey.
- 73% of vaults are misconfigured, leading to unauthorised access and exposure of sensitive data, according to the Ultimate Guide to NHIs.
- Read next: Ultimate Guide to NHIs — Regulatory and Audit Perspectives
What this signals
Identity coverage is now a control problem, not a discovery problem: when governance, vault, and federation tools each describe only their own scope, the missing identities are not just unreported, they are unmanaged. Programmes that keep the system of record inside one platform will continue to certify an incomplete estate.
Coverage boundary drift: the most useful concept in this article is that identity control breaks where tool scope ends. Once teams name that boundary explicitly, they can separate true control failures from simple connector limitations and decide where cross-system correlation is required.
A neutral identity record becomes the only practical way to reconcile human accounts, service principals, and privileged access histories without forcing every source system into the same data model. That matters because governance decisions are only as good as the population you can actually enumerate.
For practitioners
- Map each tool's coverage boundary Document exactly which identities, credentials, applications, and hosts each of IGA, PAM, and the IdP can and cannot see. Use that map to identify the places where local accounts, static keys, and unmanaged privilege can exist outside every control plane.
- Create a neutral identity ledger Establish a record that correlates identities across HR, IGA, PAM, the IdP, and unmanaged systems without making any one tool the source of truth. The aim is to preserve lineage and context even when object models do not match.
- Reconcile vault scope with privileged account discovery Compare vaulted accounts to actual privileged accounts on servers, cloud roles, and applications. Any privileged identity that is not represented in the vault should be treated as a governance gap, not as an exception to be filed away.
- Use recertification against a complete inventory Do not certify only the accounts your IGA platform already knows. Start recertification from a consolidated inventory so unconnected applications, local users, and service principals are visible in the review population.
Key takeaways
- No single identity platform can serve as a complete system of record when its visibility stops at its own connectors or vault scope.
- The article's core warning is that coverage gaps create unmanaged identities, not merely incomplete reports.
- Teams need a neutral cross-system record so governance, vault, and federation controls can act on the same identity picture.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 addresses the attack and risk surface, while NIST CSF 2.0 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST CSF 2.0 | ID.AM-01 — Physical devices and systems inventoried | The article is fundamentally about incomplete identity inventory across connected tools. |
| PR.AA-05 — Access Permissions, Entitlements and Authorizations | The article focuses on where access permissions are known versus invisible to each tool. | |
| Recommendation — Inventory identity sources and account populations across every system that holds them. Correlate entitlements across IGA, PAM, and IdP before making access decisions. | ||
| CIS Controls v8 | CIS-5 — Account Management | Account discovery and lifecycle visibility are the core governance gaps described. |
| Recommendation — Reconcile all accounts, including local and service identities, against a complete inventory. | ||
| OWASP Non-Human Identity Top 10 | NHI-01 — Improper Offboarding | Unvaulted and unmanaged identities persist because they are never fully brought into governance scope. |
| NHI-05 — Overprivileged NHI | The article highlights privileged accounts that remain outside vaulted or governed coverage. | |
| Recommendation — Track and remove identities that exist outside the governed offboarding and inventory process. Review unvaulted privileged accounts for excess scope and bring them under control. | ||
Key terms
- Identity System of Record: The authoritative source that shows what access an identity actually has. For human, machine, or agent identities, the system of record is the place where entitlement state should be reconciled after request fulfilment. Without it, ticket approvals can diverge from real access.
- Plan Boundary: The point at which an agent changes method, scope, target, or impact class, such as moving from read-only analysis to a write or delete action. Governance should treat this boundary as a mandatory re-approval checkpoint.
- Neutral Identity Record: A cross-system ledger that stores identity context without acting as the authoritative control plane for access decisions. Its job is to correlate disparate identity objects and histories so governance and PAM tools can make decisions from a complete inventory.
- Identity correlation: Identity correlation is the process of linking multiple account records to one governed subject. It lets IAM and IGA teams understand that separate usernames, principals, or emails may belong to the same employee or workload, which is essential for access review, offboarding, and entitlement analysis.
Deepen your knowledge
NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.
Published by the NHIMG editorial team on September 2, 2026.
Updated on October 11, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org