Lumos alternatives expose the limits of IdP-level identity governance

At a glance

What this is: This is an analysis of why IdP-level IGA tools hit a ceiling when governance needs extend into deep entitlements, non-human identities, and access changes made outside the identity provider.

Why it matters: It matters because practitioners responsible for IAM, IGA, and NHI governance need visibility and remediation where risk actually exists, not only where the IdP can already report.

Context

Lumos is positioned here as a SaaS-first IGA option that works well when identity data is largely limited to the identity provider layer. The article's core point is that this model becomes incomplete once governance must cover application-level entitlements, non-human identities, and changes made outside the IdP.

In identity governance terms, the gap is not just visibility. If a platform can only certify what the IdP already knows, then orphaned access, direct grants inside applications, and machine identities remain outside the governance loop. That is a structural constraint, not a tuning problem.

Key questions

Q: What breaks when identity governance stops at the IdP layer?

A: When governance stops at the IdP, the platform can certify only what the directory already knows. Fine-grained entitlements, direct application grants, and local administrative changes remain outside the control loop, so access reviews can look complete while effective privilege is still unmanaged.

Q: Why do out-of-band access changes create governance risk?

A: They create risk because the change bypasses the system that is supposed to define and review access. If a direct grant, script, or shadow admin path is never ingested, reviewers are certifying an incomplete picture and the access may persist until another control discovers it.

Q: How should teams govern non-human identities in AI-heavy environments?

A: Teams should govern non-human identities the same way they govern other privileged assets: assign ownership, minimise scope, rotate credentials regularly, and monitor for abnormal use. The key difference is speed. AI-driven workflows can exploit exposed access quickly, so detection and revocation must be automated and tied to lifecycle controls.

Q: What should organisations look for in a replacement for SaaS-only IGA?

A: They should look for deep entitlement ingestion, direct remediation, and coverage that extends beyond SaaS into custom apps, legacy systems, and non-human identities. The key test is whether the platform governs the actual authorisation layer rather than only summarising identity-provider data.

Technical breakdown

Why IdP-level data creates a governance ceiling

An IdP-level IGA tool can only reason over the attributes it receives from the identity provider, such as group membership, app assignment, and last login. That works for coarse certification, but it cannot reconstruct the actual authorization layer inside SaaS, cloud, or custom applications. Fine-grained entitlements, direct object permissions, and locally granted access sit below that data model. The result is a governance ceiling: the platform can describe access at a distance, but not govern the effective privileges that matter during abuse or audit.

Practical implication: validate whether governance decisions are based on reported access or actual authorization scope before trusting review outcomes.

Why out-of-band access changes bypass review-only remediation

If the only remediation path is a user access review, then every fix inherits the timing, workflow, and approval overhead of a certification cycle. That design assumes risk can wait until the next review window. Direct grants in applications, script-created access, shadow administrator paths, and orphaned entitlements do not respect that cadence. They also create a mismatch between detection and correction, because the issue is visible only if the platform ingests the right source data and can act without launching another review.

Practical implication: separate detection from certification so that direct revocation or entitlement adjustment is possible when the risk is immediate.

How non-human identity governance changes the architecture question

Non-human identities change the governance problem because they are not managed like employee accounts and are often distributed across APIs, workloads, integrations, and automation paths. If the platform only buckets them generically, it cannot apply identity-type-specific lifecycle or entitlement controls. That matters for service accounts, API keys, tokens, and AI agents because access scope, ownership, and offboarding all differ. The architectural question is therefore not whether the tool can list NHIs, but whether it can govern them as typed identities with distinct lifecycle and privilege expectations.

Practical implication: test whether NHI governance is type-aware enough to support ownership, lifecycle, and privilege controls separately for each identity class.

Threat narrative

Attacker objective: The objective is to retain exploitable access at the entitlement layer while remaining invisible to IdP-only governance and review-based remediation.

1. Entry occurs through access granted outside the platform, such as a direct application assignment, script-driven change, or shadow administrative path that the IdP does not surface.
2. Credential or entitlement abuse follows because the platform cannot see the fine-grained permissions that determine what the identity can actually do inside the target system.
3. Impact is governance blindness, where orphaned accounts, dormant access, and over-privileged entitlements remain active until another system or manual review exposes them.

Breaches seen in the wild

• Scania insurance portal breach 2025: An attacker used an external user login, likely stolen by infostealer malware, to take insurance claim documents from a Scania portal.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

IdP-level governance is a reporting boundary, not an identity boundary: once the governance model stops at what the IdP knows, the organisation is no longer governing effective access. The article shows that app-level permissions, direct grants, and non-human identities all live below that line. The practitioner implication is that review quality cannot exceed the quality of the entitlement data feeding it.

Review-only remediation creates a delayed-control problem: if every fix must travel through a user access review, then containment is tied to governance cadence rather than risk urgency. That assumption works for periodic certification but fails for direct entitlement drift and short-lived machine access. The implication is that governance and remediation must be separable functions.

Deep entitlement visibility is the named concept that changes the evaluation criteria: the question is no longer whether a platform can automate access reviews, but whether it can see and act on the actual authorisation layer. Once that shift happens, SaaS-first IGA looks like one governance input, not the governance system itself. Practitioners should evaluate platforms against entitlement truth, not workflow polish.

Non-human identity governance cannot be flattened into a single bucket: service accounts, API keys, tokens, and AI agents carry different lifecycle and privilege risks, so a generic NHI label hides the controls that matter. That is why type-specific governance is emerging as a requirement rather than a feature. The practitioner implication is to separate identity inventory from identity governance.

The market signal is a move from certification-first IGA toward entitlement-first identity security: the platforms gaining relevance are the ones that can unify posture, remediation, and governance across human and non-human identities. This does not make review workflows obsolete, but it does demote them from the centre of the control model. Practitioners should re-evaluate whether their current stack is built to govern or merely to report.

From our research library:

• Nearly 60% of IT leaders cite restrictive cost and complexity as a weakness of legacy identity governance, according to the 2025 State of Identity Governance Report.

What this signals

Deep entitlement visibility: the real evaluation criterion is whether a platform can see and act on the authorisation layer, not just summarise IdP signals. That distinction is increasingly decisive for organisations where risk sits inside applications, scripts, and non-human identities rather than in the directory itself.

Review-led remediation is still useful, but it is no longer sufficient as the primary control model when out-of-band changes and machine identities drive material exposure. Practitioners should treat access reviews as one input into governance, not the place where governance begins and ends.

For practitioners

• Audit where your governance data stops Map whether your current IGA stack sees only IdP attributes or also ingests app-native entitlements, direct grants, and local admin changes.
• Separate detection from certification Ensure high-risk changes can be remediated by direct revocation or entitlement adjustment instead of forcing every issue through a review cycle.
• Classify non-human identities by type Track service accounts, API keys, tokens, and AI agents separately so lifecycle ownership and offboarding rules match the identity class.
• Pressure-test out-of-band change coverage Check whether direct app assignments, scripts, and shadow admin paths are detected as governance issues or remain outside the platform's visibility.

Key takeaways

• IdP-only governance leaves effective access partially invisible, especially when privileges are created inside applications or by automation outside the directory.
• The operational gap is not limited to SaaS entitlements. It extends to direct grants, orphaned access, and non-human identities that standard review workflows often miss.
• Practitioners should evaluate whether their IAM and IGA stack can see the authorisation layer and remediate it directly, rather than relying on certification alone.

Key terms

• IdP-level governance: IdP-level governance is identity governance that only uses data exposed by the identity provider, such as group membership, app assignment, and login timestamps. It is useful for broad review workflows, but it cannot fully describe the permissions that exist inside applications or automation paths.
• Deep entitlement visibility: Deep entitlement visibility means seeing the actual permissions, roles, object access, and actions that exist inside connected systems, not just the fact that a user has an application assignment. It is the difference between knowing that access exists and knowing what that access can really do.
• Out-of-band access change: An out-of-band access change is any permission grant, revocation, or privilege adjustment made outside the primary governance platform. These changes are risky because they can bypass certification, create blind spots, and leave the recorded identity state out of sync with real authorisation.
• Non-Human Identity Governance: Non-human identity governance is the practice of managing, controlling, and auditing every machine identity across its full lifecycle. It covers service accounts, API keys, tokens, certificates, and AI agent credentials, ensuring each has a defined owner, scoped privilege, rotation schedule, and revocation path. Without governance, NHIs accumulate silently and become the primary attack surface in cloud and automated environments.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.