Physical access governance is now an identity security problem

At a glance

What this is: This article argues that physical badge and facility access must be governed as part of identity security, because disconnected records can leave people with access they no longer justify.

Why it matters: It matters because IAM, IGA and CISO teams need a single governance view across digital and physical access to reduce insider risk, safety exposure and audit gaps.

Context

Physical access governance is the set of controls that decide who can enter a site, zone or room, and under what conditions. The article argues that this is no longer a facilities-only concern because badge systems, HR records and role changes often drift out of sync, which creates an identity governance gap.

In environments such as utilities, airports, energy, pharma and manufacturing, that gap becomes operationally material. When access permissions are copied, inherited or left untouched after role changes, organisations can no longer prove that physical presence matches current authority. The result is a governance problem that sits squarely alongside IAM and IGA, not outside them.

The practical challenge is not simply whether access was once approved. It is whether access remains accurate after movers, leavers and inherited permissions accumulate across multiple sites and security systems. That is a typical enterprise problem, not an edge case.

Key questions

Q: What breaks when physical badge access is not reconciled with HR records?

A: When badge access is not reconciled with HR records, terminated staff, movers and role changes can retain physical entry rights that no longer match their authority. That creates a governance gap, because security cannot prove that the person entering a restricted space is still entitled to be there.

Q: Why do lingering access rights create both security and compliance risk?

A: Security risk rises because stale access widens the window for misuse after role change or departure. Compliance risk rises because auditors want evidence that access was removed when it was no longer justified. If you cannot show complete revocation across systems, you may have a policy that exists on paper but not in practice.

Q: How should IAM teams govern physical access across multiple sites?

A: IAM teams should treat physical access as part of the identity lifecycle, with central visibility, ownership and recertification across every facility. The key is to reconcile badge data with HR and role records, then review exceptions where access has been copied or inherited.

Q: What is the difference between digital IAM and physical access governance?

A: Digital IAM governs application and system access, while physical access governance governs entry to spaces such as floors, labs and control rooms. The controls are different, but the governance question is the same: whether the current entitlement still matches the person's role and status.

Technical breakdown

Why physical access data drifts from identity records

Physical access systems often run as separate operational environments with their own administrators, badge stores and local rules. That separation makes it easy for badge permissions to survive role changes, location changes and employment updates even when directory records have already moved on. The technical issue is not the badge itself but the lack of synchronisation between HR, IAM and facility access systems. Once those records diverge, the organisation can no longer trust that a valid badge reflects a valid entitlement.

Practical implication: treat badge data, HR status and role assignments as linked identity records, not separate operational silos.

How inherited physical access creates hidden privilege creep

The article describes a common inheritance pattern: one person’s access is copied to others because it is operationally convenient. In physical security, that usually means broad floor, suite or zone access gets replicated without validating whether the new users need it. This is a classic privilege creep pattern, but the entitlement is attached to doors, elevators and restricted areas rather than applications. Over time, inherited access can become more dangerous than overt overprovisioning because it is socially normalised and rarely challenged.

Practical implication: review copied and inherited physical entitlements as a distinct class of excess access.

Why physical access behaves like OT governance

The article treats physical security infrastructure as operational technology because it is often segmented, long-lived and managed outside mainstream IAM tooling. That matters because OT-style systems are commonly configured once and then left to age without the same review cadence applied to digital identity. When access control hardware and local policies are not governed centrally, the organisation loses visibility into shared credentials, bypass paths and unused badges. The control weakness is not lack of technology. It is lack of lifecycle governance over the systems that enforce presence.

Practical implication: bring physical access into the same lifecycle and recertification discipline used for other identity-bound systems.

Threat narrative

Attacker objective: The objective is to gain physical presence in areas where the attacker should no longer be allowed, enabling theft, disruption, surveillance or safety compromise.

1. Entry occurs when a person with outdated but still-valid badge access reaches a sensitive zone such as an executive floor, lab or control room.
2. Credential abuse occurs when access has been inherited, copied or left in place after a role change, so the badge no longer matches current authority.
3. Impact follows when excessive physical access exposes restricted areas, safety-critical systems or confidential operations to unauthorised presence.

Breaches seen in the wild

• Microsoft Midnight Blizzard breach: Midnight Blizzard (APT29) exploited legacy test account without MFA to breach Microsoft.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Physical access governance is now an identity problem, not a facilities side issue. Once badge records, HR status and role data diverge, the organisation has lost the ability to prove who should be inside a sensitive space. That is an identity governance failure because the control decision is still about entitlement, just in a physical environment. The practitioner conclusion is simple: physical access belongs in the same governance model as other identity-controlled resources.

Inherited access is the physical-world equivalent of privilege creep. Copying one person's badge permissions to multiple colleagues turns convenience into silent overprovisioning. The article shows how access can expand from a single executive corridor into broad, unreviewed entry rights across a workforce. The practitioner conclusion is to treat copied entitlements as a specific governance defect, not an administrative shortcut.

Physical security systems often operate like unmanaged OT assets. They are long-lived, localised and frequently untouched after initial configuration, which means the lifecycle assumptions behind IAM do not automatically hold. That creates an accountability gap when no one owns recertification, revocation or exception handling across sites. The practitioner conclusion is to govern facility access with the same lifecycle discipline expected for other operational identity systems.

Identity governance without validation becomes storytelling, not control. Quarterly reviews and audit claims are not enough if the underlying access data cannot be reconciled against current employment and role information. The article correctly shifts the question from whether access was once approved to whether it is still justified today. The practitioner conclusion is that proof, not process, is the control objective.

Physical presence now belongs inside the CISO's risk model. In high-risk sites, unauthorised entry can create safety, compliance and insider-risk consequences at the same time, which makes siloed facility ownership too narrow. The governance implication is broader than badge hygiene. It is the need to connect physical entitlements to enterprise identity policy so the organisation can see the full access surface.

From our research library:

• 90% of IT leaders say properly managing NHIs is essential for a successful zero-trust implementation, according to the Ultimate Guide to NHIs.
• Read next: NHI Lifecycle Management Guide

What this signals

Physical access is part of the identity surface: once a site relies on badges, local door systems and copied permissions, the access model behaves like any other entitlement problem. The governance gap appears when no team owns the full lifecycle from onboarding through role change to revocation.

Facilities data has to become identity data: CISO and IAM teams should expect physical access records to be validated against HR, role and location changes in the same way as other privileged access. Without that correlation, recertification is procedural rather than evidential.

The next governance step is to define which physical zones demand the same scrutiny as privileged systems, then align review cadence, ownership and exception handling accordingly.

For practitioners

• Consolidate physical access inventories Pull badge, turnstile and door-controller records into a single inventory so you can see who has access across sites, zones and exceptions.
• Correlate badge access with HR status Link each physical access record to current employment state, role, team and location so stale access becomes visible when people move or leave.
• Review inherited and copied entitlements Identify access assignments that were copied from another person or inherited from a role template, then challenge whether they still match need.
• Model high-risk zones as governed access domains Map executive floors, labs, control rooms and other sensitive spaces as distinct entitlement domains with explicit ownership and review cadence.
• Create site-level remediation workflows Give facilities and local security teams reports they can act on without waiting for central changes, especially where access drift is already known.

Key takeaways

• Physical access is no longer a standalone facilities issue when badge records and identity records drift apart.
• The article shows how copied, inherited and stale badge access can quietly expand entry rights across sensitive sites.
• The control lesson is to govern physical entry with the same lifecycle discipline used for other identity entitlements.

Key terms

• Physical Access Governance: The discipline of controlling who may enter a building, zone or restricted area using authoritative identity data, role context and review processes. It treats badges, doors and turnstiles as governed access assets rather than isolated facilities tools, with lifecycle controls that prevent stale or copied access from persisting.
• Inherited Access: Inherited access is permission a tool receives from a connected user, service account, or integration rather than from a purpose-built identity. It often hides privilege expansion because the tool appears lightweight while actually operating under broad, durable entitlements.
• Answer Drift: Answer drift is the gradual change in a model’s responses over time, often showing up as reduced consistency or increasing error rates. It can signal degraded grounding, shifting data quality, or prompt and retrieval issues. Monitoring drift helps teams catch reliability problems before they become widespread user-facing failures.
• Physical Identity Lifecycle: The joiner-mover-leaver process as applied to badges, site permissions and restricted-area access. It covers issuance, change, recertification and revocation, and it only works when physical entitlements are tied to HR and role state rather than treated as standalone facility records.

Deepen your knowledge

NHI governance, identity lifecycle management, and workload identity security are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.