TL;DR: Modern IGA platforms increasingly span human, non-human and agentic identities, automate provisioning and certification, and promise tighter least privilege, according to Opti. NHI Mgmt Group's view is that the core test is whether governance keeps pace with entitlement drift across fast-changing access paths, not whether reviews exist.
At a glance
What this is: NHI Mgmt Group's analysis, drawing on Opti's blog post: Modern IGA is shifting toward continuous lifecycle and entitlement governance across human, non-human and agentic identities, with least privilege and separation of duties as the central control themes.
Why it matters: This matters because IAM, IGA and PAM teams are being asked to govern more identity types with less tolerance for standing access, manual reviews and fragmented entitlement data.
Context
Identity governance fails when access changes outpace the controls meant to record, review and revoke them. Modern IGA tries to close that gap by tying identity data, lifecycle events and entitlement decisions into one governance loop.
The pressure is no longer limited to employee accounts. Service accounts, APIs, bots and AI agents now sit inside the same governance problem space, which is why lifecycle management and entitlement visibility matter as much for machine identities as for people. Treat NHI lifecycle management as part of the baseline, not a specialist add-on.
Key questions
Q: How do identity teams reduce the impact of privilege creep?
A: Identity teams reduce the impact of privilege creep by regularly reviewing entitlements, removing excess role grants and replacing always-on admin rights with just-in-time elevation. They also use access certifications, PAM controls and the remove standing privilege pattern so users keep only the access needed for current duties, rather than retaining permissions from past roles.
Q: Why do access reviews often fail to reduce identity risk?
A: Access reviews fail when they validate stale roles instead of live entitlements. If reviewers cannot see inherited access, app-specific permissions, and segregation of duties conflicts, the review produces approval noise rather than risk reduction. Effective certification needs current entitlement data and business context for every decision.
Q: How do separation of duties controls change for service accounts?
A: Separation of duties for service accounts is enforced by splitting ownership, provisioning, approval, and use so no single administrator can create, approve, and wield the same credential. The account should have a named business owner, scoped permissions, separate secret custody, and independent review of the full entitlement graph. Where possible, use distinct service accounts per application function and remove standing broad privileges.
Q: What should teams do when access is still lingering after offboarding?
A: Reconcile the identity source of truth against all downstream applications, revoke any entitlement that should have been removed, and verify that logs show the change end to end. If offboarding lingers, the issue is not just one missed account. It usually indicates a broken linkage between HR, IAM, and application provisioning.
Technical breakdown
Why static certification cycles miss modern entitlement drift
Classic certification assumes access changes slowly enough to be reviewed after the fact. In distributed environments, entitlements change through role moves, cloud app updates, delegated admin actions and automation, so the state being reviewed may already be stale. Continuous reconciliation narrows that gap by comparing expected entitlements to observed access and flagging divergence before it becomes privilege creep. The deeper issue is not review volume alone, but timing. If governance only samples access periodically, it cannot reliably prove who currently has what and why. See the Access Reviews and Certification Guide.
Practical implication: Move from campaign-only reviews to continuous entitlement reconciliation for high-change identities.
How closed-loop provisioning changes the governance model
Closed-loop provisioning means the system does not stop at sending an access change to a target application. It verifies that the change landed, checks whether the resulting state matches policy, and keeps monitoring for drift or rollback failures. That matters because failed deprovisioning is one of the most common reasons orphaned accounts persist after role changes or offboarding. Without the loop, governance becomes transactional rather than stateful, and the organisation loses confidence that requested access changes actually took effect.
Practical implication: Require confirmation that provisioning and deprovisioning actions are completed, not merely submitted.
Why separation of duties must extend beyond human roles
SoD is often treated as a finance or approvals control, but its real value is preventing dangerous permission combinations wherever they appear. In modern identity estates, conflicting access can be split across SaaS roles, privileged cloud permissions, service accounts and automation credentials, so the conflict is no longer visible in one system. Governance therefore has to reason across identity types and connected entitlements, not just named users. If SoD remains human-only, hidden cross-system privilege combinations survive untouched. See the Segregation of Duties (SoD) Guide.
Practical implication: Extend SoD rules to machine identities and cross-application entitlement combinations.
Threat narrative
Attacker objective: The objective is to turn unmanaged identity state into durable access that survives normal review and offboarding cycles.
- Entry begins when an identity is created or inherited outside effective governance, such as a stale account, an overbroad connector permission or an unmanaged service identity.
- Escalation follows when the account retains access longer than its business need, allowing privilege creep or orphaned entitlements to persist across systems.
- Impact occurs when excessive access, weak offboarding or unresolved drift gives an attacker or insider a broader blast radius than the organisation intended.
Breaches seen in the wild
- Azure Key Vault Contributor escalation 2024: Datadog found Azure Key Vault Contributor could add itself to access policies and read every secret, key and certificate in a vault.
- OneLogin API flaw (CVE-2025-59363): A OneLogin API flaw exposed OIDC client secrets to anyone with an API key, including vendors (CVE-2025-59363); fixed with no customer impact.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Modern IGA is no longer just an access review layer. It is becoming the control plane for entitlement state across people, workloads and agentic systems. That shift matters because the hard problem is not issuing access once, but proving the right access still exists for the right reason as systems change. Practitioners should judge IGA by how well it governs state drift, not by how many workflows it automates.
Least privilege fails when governance is too late in the lifecycle. Access reviews that happen after provisioning assume the risky state will still be visible when the campaign opens. In fast-moving environments, that assumption is weak, which is why lifecycle automation and continuous reconciliation are now part of the control, not a convenience feature. Teams should measure how quickly a policy violation becomes visible and revocable.
Identity governance must absorb non-human and agentic identities into the same discipline. Service accounts, APIs and AI agents do not reduce governance complexity; they multiply the number of identity states that can drift, persist or be forgotten. The field should stop treating machine identities as edge cases and start treating them as core governance inventory. Unified identity governance is now the baseline expectation.
Closed-loop execution is the named concept that matters here. The practical failure mode is not simply weak provisioning, but incomplete proof that access changes were actually executed and held. Organisations that cannot verify the final state after a request, approval or offboarding step are running governance on assumption rather than evidence. Practitioners should treat execution verification as a control objective in its own right.
Separation of duties now has to be evaluated across connected entitlements, not just named users. A modern policy can look clean at the person level while a service account or connector permission quietly recreates the forbidden combination elsewhere. That changes the governance question from who approved access to where the conflict reappears after provisioning. Security teams should extend SoD analysis across the full entitlement graph.
From our research library:
- 97% of NHIs carry excessive privileges, increasing unauthorised access and broadening the attack surface, according to the Ultimate Guide to NHIs.
- Read next: NHI Lifecycle Management Guide
What this signals
Closed-loop governance: Identity programmes are moving toward evidence of execution, not just evidence of intent. That means access requests, certifications and offboarding steps have to be validated against live state, or the control environment remains vulnerable to stale entitlements and orphan accounts.
The biggest programme shift is that identity governance now has to encompass human and non-human identities in one operating model. If service accounts, APIs and agents sit outside the same review and offboarding discipline, the organisation will keep producing access drift in the exact places attackers prefer.
Continuous reconciliation is becoming the real measure of governance maturity. Periodic review still has value, but it is no longer sufficient when permissions can change between meetings, workflows and deployments.
For practitioners
- Audit entitlement drift continuously Compare expected access against live permissions for high-change identities, including users, service accounts and automation identities, so drift is detected before it becomes normalised. See the Access Reviews and Certification Guide.
- Verify offboarding actually removes access Check that deprovisioning, token revocation and account disablement are confirmed in target systems, not just requested in a workflow.
- Extend SoD rules beyond employee accounts Model conflicting permissions across SaaS roles, privileged cloud access and machine identities, then block combinations that recreate the same control conflict in different systems.
- Build one inventory for human and non-human identities Unify identity records across HR, directories, SaaS platforms and automation estates so reviews and certifications work from a single entitlement view. See the IAM and IGA Basics.
Key takeaways
- Modern IGA only reduces risk when it governs access state continuously, not just during periodic certification windows.
- Machine identities and agentic systems expand the governance surface, so lifecycle control must extend beyond human users.
- Closed-loop provisioning, reconciliation and broader SoD rules are the controls that determine whether entitlement drift is contained or normalized.
Related NHI Mgmt Group resources: IAM and IGA Basics · NHI Lifecycle Management Guide · Segregation of Duties (SoD) Guide · Access Reviews and Certification Guide
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 addresses the attack and risk surface, while NIST CSF 2.0, CIS Controls v8 and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-05 — Overprivileged NHI | This article centres on excessive permissions across machine identities and agentic access paths. |
| NHI-09 — NHI Reuse | Shared governance patterns across users, service accounts and agents can hide reused access state. | |
| Recommendation — Map entitlement drift and excess access to NHI-05 and remove permissions that are not needed for the task. Identify reused credentials and overlapping entitlements that persist across identity types and clean them up. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | Modern IGA is fundamentally about controlling entitlements and authorisations across changing identity states. |
| Recommendation — Review entitlement governance so current permissions match business need and least privilege expectations. | ||
| CIS Controls v8 | CIS-5 — Account Management | IGA lifecycle automation and offboarding are direct account management concerns in this article. |
| Recommendation — Centralise account lifecycle controls so creation, change and removal are verified across all connected systems. | ||
| NIST SP 800-53 Rev 5 | AC-6 — Least Privilege | Least privilege is a stated governance goal and a central control theme throughout the article. |
| Recommendation — Enforce least privilege by removing unnecessary permissions and validating access against current job need. | ||
Key terms
- Identity Governance and Administration (IGA): A framework of policies, processes, and technology to manage and govern digital identities and their access rights. Increasingly extended to cover non-human identities alongside human users.
- Least Privilege: A security principle requiring that every identity, human or non-human, is granted only the minimum permissions necessary to perform its function. Least privilege is the single most effective control for reducing NHI blast radius.
- Separation Of Duties: Separation of Duties is a control that splits critical tasks across different people or systems so no single identity can complete an entire sensitive process alone. In IAM and NHI governance, it reduces fraud, error, and abuse by separating provisioning, approval, execution, and review privileges across distinct roles or accounts.
- Privilege Creep: Privilege creep is the gradual accumulation of access rights beyond what an identity actually needs. It usually happens when permissions are added for convenience and never removed. For NHIs, privilege creep expands blast radius and makes old credentials far more dangerous than their original purpose suggests.
Deepen your knowledge
NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.
Published by the NHIMG editorial team on November 4, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org