Modern identity at scale means governance must become continuous

At a glance

What this is: This product update argues that identity governance now needs continuous, time-bound workflows because static approvals and quarterly checkpoints no longer fit how access is requested and reviewed at scale.

Why it matters: It matters because IAM and IGA teams have to govern human access, non-human access, and delegated workflows with controls that keep up with real operating cadence, not calendar cadence.

👉 Read C1.ai's January product updates on modern identity governance at scale

Context

Modern identity governance is moving away from periodic checkpointing and toward continuous control of requests, reviews, and revocations. That shift matters because access now changes across infrastructure, SaaS, and operations as part of normal work, not as an occasional exception.

C1.ai frames January’s updates around making identity governance more service-oriented, more observable, and less dependent on manual coordination. The practical question for IAM and IGA teams is whether their current review and approval model still matches how access actually flows through the organisation.

Key questions

Q: How can identity teams keep pace with access changes in modern environments?

A: Identity teams should connect policy enforcement to live events such as role changes, new integrations, and unexpected privilege grants. That approach reduces the delay between detection and remediation, which is where many governance failures occur. It also works better for NHIs and AI-connected access than quarterly review cycles do.

Q: What breaks when access reviews stay quarterly in a fast-moving environment?

A: Quarterly reviews can miss entitlement drift, delay remediation, and leave teams working from stale access context. In practice, the control becomes a cleanup exercise rather than a live governance mechanism, which is why continuous monitoring matters for dynamic estates.

Q: What are the signs that identity governance is not working in practice?

A: Common warning signs are repeated access workarounds, ignored approval workflows, super admins holding too much power, and teams bypassing the process because it is too slow or hard to use. If access reviews are always behind, permissions stay stale, and IT has to chase owners for answers, governance is operating more as paperwork than control.

Q: Should organisations centralise approvals or decentralise self-service for identity workflows?

A: The better pattern is governed self-service for routine work and tighter approval control for high-risk actions. That keeps operational speed where the risk is low while preserving explicit oversight where standing privilege or sensitive change would otherwise expand exposure.

Technical breakdown

Why quarterly access reviews break at scale

Periodic reviews assume access remains stable long enough to be collected, assessed, and certified. In modern environments, access can change faster than the review cycle, especially when requests, extensions, and deprovisioning happen across multiple workflows. That makes the review itself a lagging control unless it is paired with live visibility into grants, expiry, and decision timing. The technical issue is not just volume, but timing. When governance is batch-oriented while access is continuous, the control sees an older state than the one the business is actually using.

Practical implication: move review governance closer to the point where access changes, not just the point where it is certified.

How governed self-service changes the identity control plane

Requestable automations turn backend workflows into catalogued services, which reduces the need for direct admin access. The control shift is important: instead of granting broad privilege for convenience, teams expose a constrained workflow that collects structured input, enforces policy-based approvals, and executes with auditability. That changes identity governance from permissioning people to permissioning outcomes. It also means access control must be designed around the service boundary, not around the underlying privileged account. The governance question becomes whether the workflow itself is the controlled asset.

Practical implication: define the workflow as the governed unit and keep privileged execution behind policy and audit rather than user access.

Why observability is now part of identity governance

The update to the access operations dashboard shows that governance is no longer only about deciding yes or no. Teams also need to see expiring grants, extension requests, and response-time patterns to understand where workflows are stalling or drifting. Percentile-based views matter because averages hide bottlenecks and review behaviour that only becomes visible under load. In practice, observability turns governance into an operational system rather than a periodic compliance exercise. Without those metrics, teams cannot tell whether review workloads are healthy or merely passing through.

Practical implication: instrument access review and extension workflows with metrics that reveal delay, backlog, and exception patterns.

NHI Mgmt Group analysis

Continuous governance is becoming the operating model for modern identity programmes: static approvals and quarterly checkpoints do not map to environments where access changes continuously across infrastructure, SaaS, and operations. The stronger pattern is governance that follows the workflow, not the calendar. That shift matters for human IAM, NHI governance, and delegated admin flows because the control has to stay aligned with actual access movement.

Identity as a service layer is now a governance design pattern, not a convenience feature: exposing requestable automations through a controlled catalog allows teams to give users what they need without expanding standing privilege. The key insight is that the controlled object is the workflow outcome, not the underlying account. Practitioners should treat this as a way to constrain administrative reach while preserving operational speed.

Review productivity is a governance signal, not just a user-experience metric: batch submission, submission tracking, and percentile-based dashboards all point to the same discipline, which is making review work observable enough to govern at scale. When reviewers can act incrementally and admins can see timing and decision patterns, the programme moves from episodic cleanup to managed flow. That is the difference between access certification as a ritual and access governance as a system.

Access review programmes fail when they are built around human memory instead of operational evidence: extension tasks, deprovisioning continuity, and fallback handling show that edge cases are where governance breaks first. The named concept here is governance continuity under exception load: a programme is only as real as its ability to preserve auditability when reviewers are unavailable or accounts change state mid-workflow. Practitioners should test the exception path, not just the happy path.

What changes here is the control boundary: identity governance is shifting from periodic entitlement checking to continuous entitlement state management. That breaks the assumption that access can be reviewed after the fact without losing context. For practitioners, the implication is that governance must be designed as an always-on control plane across approval, execution, and revocation.

What this signals

Governance continuity under exception load: identity programmes often look healthy until reviewer unavailability, automatic deprovisioning, or extension handling creates a gap in audit continuity. The real test is whether the workflow still produces a clear, reviewable state when the process stops behaving as planned.

As identity work becomes more service-oriented, teams should expect governance to behave like an operational platform rather than a periodic checkpoint. That means measuring delay, exception handling, and workflow completeness as first-class controls, not afterthought metrics.

For practitioners

• Define the governed workflow boundary Treat requestable automations, onboarding, offboarding, and scoped admin tasks as governed services with policy checks, structured intake, and audit trails instead of ad hoc admin actions.
• Instrument review operations for timing signals Track submission timing, expiring grants, extension requests, and response-time percentiles so you can see where access review work is stalling or repeatedly requiring intervention.
• Test exception handling under deprovisioning Validate what happens to extensions, fallback paths, and review continuity when accounts are removed automatically or reviewers are unavailable, then fix the workflow before it becomes a gap.
• Replace standing admin access with catalogued tasks Expose recurring backend work through controlled request flows so users can request outcomes without receiving persistent elevated roles.
• Use percentile views to find governance bottlenecks Look beyond averages and inspect the slowest review and approval paths to identify workload spikes, repeated delays, and teams that need workflow redesign.

Key takeaways

• Modern identity governance is moving toward continuous control because access now changes faster than static approval cycles can absorb.
• The operational value is not just automation, but visibility into review timing, extensions, and bottlenecks that reveal whether governance is actually keeping pace.
• Practitioners should redesign identity workflows so request, approval, execution, and revocation stay auditable even when the process moves faster than manual review.

Key terms

• Continuous Identity Governance: An operating model where access decisions, lifecycle changes, and risk signals are handled as an ongoing process rather than a periodic campaign. It uses authoritative events, telemetry, and policy automation to keep access aligned with current business and security conditions.
• Controlled Self-Service: Controlled self-service is a delivery model where users can access approved tools quickly without waiting on manual IT support, while the organisation still controls data, permissions, and oversight. It reduces the incentive for shadow IT by making sanctioned options easier to use than unofficial alternatives.
• Review Batch Submission: A review workflow that lets decision-makers complete multiple access certifications incrementally and submit them together when ready. It helps reduce context switching, but it still depends on current and accurate entitlement data to remain meaningful.
• Governance Continuity: Governance continuity means identity controls remain intact as organisations change platforms, expand identity types, or migrate programmes. It is the ability to preserve policy, oversight, and accountability during transition so security does not weaken while new capabilities are introduced or old environments are modernised.

What's in the full article

C1.ai's full blog post covers the operational detail this post intentionally leaves for the source:

• Weekly release note context behind the January product changes and how they fit the 2026 roadmap
• Details on batch submission for access reviews, including how reviewers can submit decisions incrementally
• Examples of the new dashboard metrics for expiring grants, extension requests, and response-time analysis
• More information on the CEL logic improvements, fallback handling, and accessibility changes

👉 The full C1.ai post covers the release-note detail behind review batching, dashboard metrics, and workflow changes.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.