Manual access governance hides control debt at scale

At a glance

What this is: NHI Mgmt Group's analysis, drawing on READI's blog post: Manual access governance can satisfy audit paperwork while leaving revocation, repeatability, and current-state control unresolved.

Why it matters: IAM, IGA, and PAM teams need to distinguish evidence of review activity from actual enforcement, especially where disconnected systems still depend on manual certification and offboarding.

Context

Manual governance becomes a governance gap when a team can show proof of review but cannot prove the underlying access state is still correct. The weak point is not the spreadsheet itself, but the assumption that a snapshot can stand in for live entitlement control across applications that are hard to integrate.

In disconnected application estates, certification often substitutes for enforcement because the process is easier to run than the control is to automate. That is a familiar pattern in IAM and IGA basics, but it becomes more costly when offboarding, role change, and periodic review all depend on human memory and queue timing.

The result is a control model that looks compliant in evidence packs while drifting in practice. The article's central problem is not lack of activity, but lack of repeatable state control.

Key questions

Q: How can security teams know whether access reviews are producing real control?

A: They should compare review outputs with live HR, IdP, and application state, then check whether drift keeps reappearing between cycles. If certifications routinely approve outdated roles or miss orphaned entitlements, the campaign is producing documentation rather than governance. Fresh data and post-review drift are the clearest indicators of control quality.

Q: Why do manual offboarding processes create identity risk?

A: Manual offboarding creates identity risk because it depends on people remembering every connected system and every entitlement path. That increases the chance of missed revocation, especially in SaaS stacks with billing, reporting, and delegated admin functions. Stale access then remains active long after the relationship ends.

Q: How should I prioritise disconnected applications for identity governance?

A: Prioritise disconnected applications by identity risk, starting with systems that grant privileged access, hold sensitive data, or rely on exports, email approvals, and manual re-imports. Focus first on applications with no API or SCIM connector, because manual entitlements, delayed joins and leavers, and weak evidence trails create governance gaps. Rank by business criticality, number of accounts, and frequency of access change.

Q: What is the difference between access approval and access control evidence?

A: Approval is a workflow event that says someone granted permission. Evidence is the structured record that proves the decision was justified, policy-aware, and traceable through provisioning and usage. In regulated environments, approval without evidence leaves too much ambiguity for auditors and weakens the organisation’s ability to defend least privilege.

Technical breakdown

Why manual certification creates stale entitlement snapshots

Manual access certification is a point-in-time process. Teams export an account list, collect approvals, and re-import the result, which means the evidence reflects the state at the moment of the export, not the state after subsequent joins, moves, or leavers. The control is informational unless the application can accept and enforce the approved change back into the system of record. Without that feedback loop, certification becomes a record of intent rather than a control over entitlements. See the Access Reviews and Certification Guide.

Practical implication: Treat certification outputs as evidence only when they are coupled to enforced entitlement changes in the target system.

Why offboarding slows down when governance stays manual

Manual offboarding introduces queue latency between a leaver event and actual privilege removal. That delay is especially risky for privileged or business-critical applications because the access remains usable while the ticket moves through review, assignment, and execution. The governance problem is not simply process inefficiency. It is that revocation depends on people remembering the right workflow for each application, so the control weakens exactly when urgency is highest. See the NHI Lifecycle Management Guide.

Practical implication: Map every manual offboarding path to the identities and applications where revocation delay creates the largest exposure window.

How disconnected apps turn governance into control debt

Disconnected applications force identity teams into compensating controls because the platform cannot natively consume access changes. Over time, those exceptions accumulate as control debt: more application-specific steps, more brittle knowledge, and more reliance on spreadsheets and tribal memory. The governance model may still produce audit artifacts, but each new exception widens the gap between documented process and actual enforcement. That is why scale changes the risk profile from inconvenience to structural weakness. See the IGA Buyer's Guide.

Practical implication: Inventory the applications still governed by hand and classify them by business criticality, not by how easy the review process feels.

Threat narrative

Attacker objective: The attacker benefits from the time window created when access remains active after it should have been removed.

1. Entry begins with a disconnected application or legacy connector gap that prevents direct, automated governance.
2. Credential or account changes are then handled through manual reviews, exported lists, and ticket queues instead of enforced state updates.
3. Escalation appears as standing access that outlives role change or departure because revocation waits for human processing.
4. Impact is delayed removal of access, audit findings, and exposure windows that can be exploited before the next manual cycle.

Breaches seen in the wild

• Ledger Connect Kit npm compromise 2023: Attackers phished a former Ledger employee with unrevoked npm access and published a wallet-draining Connect Kit, stealing about $600k on 14 Dec 2023.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Manual governance creates control debt, not just operational friction: When access reviews rely on exported lists and human follow-up, the organisation accrues a gap between documented approval and live enforcement. That gap is survivable in a small estate, but it becomes structural as more applications stay disconnected from the identity stack. The practical consequence is that audit evidence grows faster than actual control.

Access certification is not the same thing as entitlement control: A signed-off review proves that someone reviewed a record, not that the underlying access was removed or corrected in the target system. That distinction matters because the record can be complete while the privilege state has already drifted. Practitioners should treat certification as one governance input, not the control itself.

Offboarding delay is where manual governance fails most visibly: The article's hidden-cost argument is really about revocation latency. When a leaver event depends on a queue and a person remembering the right system-specific steps, the organisation extends the life of access beyond the moment it should end. That is why manual offboarding is not an administrative inconvenience but a governance exposure.

Control visibility without control execution is a false comfort pattern: The most dangerous assumption is that a platform can be “governed” if it can be observed. That assumption fails whenever the process can produce evidence but cannot push a state change back into the application. The result is governance theatre unless the organisation can make approvals operationally binding.

Disconnected applications need a lifecycle model, not an exception list: The named concept here is control debt from disconnected applications: the longer a system remains outside automated governance, the more the organisation depends on bespoke human memory to keep access current. That debt compounds across audits, offboarding, and role changes, so the next step is to measure where manual control has become the default.

From our research library:

• Only 20% have formal processes for offboarding and revoking API keys, and even fewer have procedures for rotating them, according to the Ultimate Guide to NHIs.
• Read next: NHI Lifecycle Management Guide

What this signals

Control debt from disconnected applications: Manual governance does not fail all at once. It accumulates as more systems stay outside direct enforcement, so the programme ends up paying for evidence assembly, rework, and delayed revocation at the same time. The practical signal is that manual exceptions should be treated as a lifecycle problem, not a temporary operating mode.

The next governance shift is to decide where a review-only model is no longer acceptable. Once a system is important enough to carry meaningful access risk, the organisation needs enforced entitlement changes, not just completed review artefacts. That is the point where disconnected applications move from inconvenience to programme-level exposure.

For practitioners

• Classify manual governance as a control gap, not a process variant Separate applications that are merely reviewed from those whose access can actually be enforced, then rank them by business criticality and entitlement risk.
• Measure revocation latency by application Track the elapsed time between a leaver or role-change event and the actual removal of access, then use that lag to prioritise the worst manual workflows.
• Tie every certification to a live system change Require the review process to trigger or verify an actual entitlement update in the target system, not just a spreadsheet mark-off.
• Reduce exception handling before the next audit cycle Identify the applications still governed by export, email, and re-import patterns, then decide which ones need automation, tighter ownership, or decommissioning.

Key takeaways

• Manual access governance can satisfy audit expectations while still leaving access state uncontrolled in practice.
• The hidden cost is not only administrative overhead but delayed revocation, stale entitlements, and control debt that compounds with scale.
• The strongest corrective action is to connect review activity to live entitlement changes and measure where manual offboarding creates the longest exposure window.

Related NHI Mgmt Group resources: NHI Lifecycle Management Guide · Access Reviews and Certification Guide · IGA Buyer's Guide · Coupang Signing Key Breach

Key terms

• Access Certification: Access certification is the periodic review of whether an identity still needs its current entitlements. For NHIs, certification is only reliable when reviewers know the identity's owner, purpose, and expiry, otherwise stale machine access can persist long after the original use case has ended.
• Manual Governance Loop: A manual governance loop is a recurring identity process that depends on spreadsheet exports, email approvals, or human reconciliation to keep access records usable. It often appears when automation sits on top of inconsistent identity data. The loop creates latency, increases error rates, and hides the real source of control failure.
• Revocation Latency: Revocation latency is the time between a decision to remove access and the point at which that access is actually gone. It is a practical measure of how long stale privilege remains usable after a role change, offboarding, or contract end. Shorter latency means smaller exposure and cleaner audit evidence.
• Control Debt: Control debt is the accumulation of weak, custom, or poorly owned security decisions that make future governance harder. In identity programmes, it appears when exceptions, one-off workflows, and legacy process assumptions become embedded in the access model and are expensive to unwind later.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.