MTX and Oleria partnership raises the bar for identity governance

At a glance

What this is: MTX Group and Oleria Security are positioning continuous identity governance as the answer to access sprawl across employees, service accounts, machine identities, and AI agents in regulated environments.

Why it matters: IAM, IGA, and PAM teams need to treat access review, lifecycle management, and standing privilege as continuous controls across human and non-human estates, not periodic admin tasks.

Context

This partnership sits in the gap between modernisation programmes and legacy identity governance models. As cloud adoption and AI initiatives expand the number of employees, contractors, applications, service accounts, machine identities, and AI agents that can hold access, periodic review cycles struggle to keep pace.

For identity governance teams, the problem is not just visibility. The harder issue is whether lifecycle management, access certification, and privilege removal can operate continuously across human, NHI, and AI identities without breaking regulated operations or slowing transformation programmes.

Key questions

Q: How should security teams govern access across human, NHI, and AI identities?

A: Security teams should govern all three through a shared lifecycle and policy layer, but with different operating rules for each actor type. Humans need review and approval flows, NHIs need ownership, rotation, and offboarding discipline, and AI agents need continuous control over actions, permissions, and escalation paths. The key is to keep governance consistent without forcing one workflow onto every identity class.

Q: Why does standing privilege still create so much identity risk?

A: Standing privilege keeps elevated access available long after the work that justified it has ended. That increases blast radius, weakens accountability, and makes review processes chase a moving target. Just-in-time access only helps when elevation is short-lived, context-aware, and paired with clean role design and reliable offboarding.

Q: What breaks when access reviews are only run on a fixed schedule?

A: Fixed-cycle reviews encourage repetition, not judgment. Reviewers see the same access over and over, approve it because it looks familiar, and miss the changes that actually matter. Risk-based reviews tied to role change, privilege growth, and inactivity are far more effective than calendar compliance.

Q: What should regulated organisations do to keep governance aligned with cloud and AI adoption?

A: They should bind governance to lifecycle events, usage context, and privilege changes so compliance evidence is generated as access changes. That makes it possible to modernise without losing control over human and non-human identities that now move through the environment at different speeds.

How it works in practice

Why point-in-time access reviews miss fast-changing identity estates

Traditional IGA assumes access can be sampled, reviewed, and certified on a schedule. That model works poorly when entitlements change continuously across employees, contractors, service accounts, machine identities, and AI agents. The practical weakness is timing: by the time a review happens, the access state may already be obsolete. Continuous governance shifts the control point from retrospective certification to ongoing evaluation of entitlement changes, privilege scope, and lifecycle events.

Practical implication: move review logic closer to issuance, change, and revocation events rather than relying on periodic certification alone.

How standing privilege creates unnecessary identity blast radius

Standing privilege is persistent access that remains available between tasks or sessions. In mixed identity estates, it expands blast radius because a compromised account or over-scoped service identity can continue to act long after the original business need has passed. The article ties the partnership to eliminating standing privilege, which matters because access should be narrowly time-bound and context-bound for both human and machine identities. The governance issue is not just excess access, but access that persists without active justification.

Practical implication: inventory persistent privileges across human and non-human identities and treat them as exposure, not convenience.

Why continuous lifecycle management matters for NHI and AI identities

Lifecycle management for non-human and AI identities is different from human joiner-mover-leaver handling only in the speed and automation required, not in the governance intent. Service accounts, machine identities, and AI agents can be created, reused, over-permissioned, and left behind as environments change. A continuous model tries to close that gap by tying governance to identity context, usage, and risk rather than to manual ticketing or calendar-based recertification. That is the right architectural direction for regulated environments trying to scale cloud and AI adoption.

Practical implication: apply lifecycle controls to every non-human identity with the same offboarding discipline you expect for people, but with machine-speed enforcement.

NHI Mgmt Group analysis

Continuous governance is becoming the default control model for mixed identity estates. Periodic access reviews were designed for slower-moving environments where entitlements could be certified after the fact. That assumption fails when human, NHI, and AI access changes continuously across cloud and digital transformation programmes. The implication is that governance itself is shifting from a calendar activity to a runtime control discipline.

Standing privilege is now a governance liability, not an operational shortcut. The article's emphasis on eliminating standing privilege reflects a broader shift in identity security: persistent access creates unnecessary blast radius across regulated environments. When access is meant to support transformation and compliance at the same time, every unused entitlement becomes a risk surface. Practitioners should treat persistence as exposure unless the business case is active and bounded.

Continuous identity governance exposes the limits of legacy IGA architecture. Legacy tools were built around point-in-time certification, manual workflows, and static identity assumptions. That design breaks down when the estate includes service accounts, machine identities, and AI agents whose access state can change faster than review cycles. The named concept here is identity state drift: access changes faster than governance can certify it, so the control must observe state continuously. Practitioners need governance models that follow identity state, not quarterly process.

AI and NHI governance are converging around the same control problem. Human accounts, service accounts, machine identities, and AI agents all require lifecycle ownership, entitlement boundaries, and audit-ready evidence, even if their operational patterns differ. This is where identity governance stops being a human IAM function and becomes an enterprise access control fabric. The practical conclusion is that organisations should stop separating policy design by identity label and start designing by access behaviour.

Regulated industries will judge identity governance by operational continuity, not policy intent. Public sector, healthcare, education, and other regulated environments need evidence that access is governed as it changes, not just documented after review. This matters because digital transformation increases the number of identities that can create audit and compliance exposure. The practitioner takeaway is simple: governance must be continuous enough to survive cloud scale and AI adoption.

From our research library:

• Nearly 60% of IT leaders cite restrictive cost and complexity as a weakness of legacy identity governance, according to the 2025 State of Identity Governance Report.

What this signals

Identity state drift: access now changes faster than many governance programmes can certify it. That means the real control question is not whether access was reviewed, but whether the programme can observe entitlement change in time to act on it.

Continuous governance will increasingly define audit readiness in regulated environments. If identity evidence is only assembled after the fact, the programme will always trail cloud and AI adoption rather than constrain it.

For practitioners

• Map all identity classes to one governance model Bring employees, contractors, service accounts, machine identities, and AI agents into a single access governance inventory so review and revocation rules are consistent across identity types.
• Eliminate persistent access where the business case is weak Identify standing privilege in human and non-human accounts, then remove it where tasks can be completed with time-bound or context-bound access instead.
• Tie lifecycle controls to identity state changes Trigger certification, revocation, and reassignment actions from creation, role change, service change, and decommission events instead of relying on periodic campaigns.
• Align audit evidence to continuous governance Capture access context, approval history, and privilege changes in a form that auditors can trace without reconstructing access from multiple point-in-time snapshots.

Key takeaways

• The central problem is not access volume alone, but the mismatch between fast-changing identity estates and governance models built for slower review cycles.
• The partnership underscores a shift toward continuous lifecycle management, automated access reviews, and removal of standing privilege across human, NHI, and AI identities.
• Practitioners should rework identity governance around state changes and persistent exposure, because point-in-time certification no longer captures how access actually behaves.

Key terms

• Continuous Identity Governance: An operating model where access decisions, lifecycle changes, and risk signals are handled as an ongoing process rather than a periodic campaign. It uses authoritative events, telemetry, and policy automation to keep access aligned with current business and security conditions.
• Standing Privilege: Standing privilege is access that remains active even when no immediate task requires it. For NHI programmes, it is a common failure mode because long-lived credentials and persistent roles create unnecessary exposure. Reducing standing privilege usually means tighter expiry, on-demand access, and clearer review of who or what still needs access.
• Identity state change: Identity state change is any event that alters how an account is trusted, recovered, enrolled, or authorised, such as password reset, authenticator registration, or provider reassignment. These events are security-sensitive because they can create or remove trust without changing the underlying user.
• Lifecycle Management: Lifecycle management is the process of creating, reviewing, rotating, and retiring identities and their secrets in a controlled way. For NHIs, it is essential because stale credentials, orphaned accounts, and incomplete offboarding are common paths to long-lived exposure and unauthorised access.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.