PIAM, IAM and PACS expose the identity governance gap

At a glance

What this is: This is a governance explainer showing that IAM and PACS solve different halves of the access problem, while PIAM is positioned as the layer that ties identity lifecycle events to both digital and physical access.

Why it matters: It matters because IAM teams, physical security teams, and IGA leads often revoke one form of access while missing the other, creating avoidable exposure when employment or role changes are not propagated everywhere.

Context

Identity governance breaks down when an organisation treats digital access and physical access as separate operating models. IAM decides who can log into systems, while PACS decides which badge opens which door. The article’s core point is that neither domain alone provides full lifecycle governance across the enterprise.

That gap shows up in ordinary joiner, mover, and leaver events. A terminated employee can lose application access while retaining badge access, or a new hire can be present in HR while waiting days for both systems to catch up. PIAM is presented as the coordination layer that turns those events into consistent policy enforcement across both domains.

Key questions

Q: Where does identity governance fail when IAM and PACS are run separately?

A: It fails at propagation. A termination, transfer, or contractor end date can close a login while leaving a badge active, or revoke a badge while digital access remains open. The gap is not abstract, it is the time and coordination needed to make one lifecycle event take effect everywhere it should.

Q: Why do physical badges create risk when they are not tied to HR and IAM events?

A: Because a badge is still an entitlement, and entitlements only stay safe when they follow the current employment or engagement state. If PACS does not receive authoritative HR and identity updates, a valid credential can outlive the business need for access and become an unauthorised entry path.

Q: What breaks when access reviews cover digital systems but not physical access?

A: You get an incomplete picture of who can actually reach people, spaces, or assets. A recertification process that ignores badges and door permissions can certify a clean application profile while leaving the same person able to enter restricted facilities. The review looks effective, but the entitlement set is only half governed.

Q: How should organisations decide whether PIAM is needed alongside IAM?

A: They should ask whether the same identity lifecycle must govern both digital and physical access, and whether those domains are currently changing in sync. If facilities, contractors, visitors, or multi-site operations create separate revocation paths, PIAM becomes a governance requirement rather than a convenience layer.

Technical breakdown

Why IAM cannot govern physical access on its own

IAM governs authentication, authorisation, and account lifecycle for digital resources such as applications, cloud services, and networks. Its controls stop at the digital edge, so a revoked login does not tell you whether a badge, turnstile credential, or door schedule is still active elsewhere. That is an architectural boundary, not an implementation bug. The result is split-state governance: one identity record may be closed in IT while the physical access path remains open in building security. For identity architects, the key technical issue is propagation, not policy intent. Practical implication: treat physical access as a separate entitlement domain that must be governed, not assumed to follow IAM changes automatically.

Practical implication: treat physical access as a separate entitlement domain that must be governed, not assumed to follow IAM changes automatically.

How PACS handles doors without understanding identity lifecycle

PACS is built to enforce door-level decisions in real time. It knows whether a credential should open a reader at a given time, but it does not inherently know whether the holder is still employed, on the right assignment, or offboarded in HR. That makes it access-centric rather than identity-centric. In practice, PACS can continue to honour a valid credential long after the business reason for that credential has changed. For security leaders, the technical limitation is that a badge system can enforce rules locally while remaining blind to lifecycle truth upstream. Practical implication: govern PACS as a downstream enforcement point and connect it to authoritative identity and HR events.

Practical implication: govern PACS as a downstream enforcement point and connect it to authoritative identity and HR events.

What PIAM changes in cross-domain lifecycle orchestration

PIAM is described here as the governance layer that binds HR, IAM, and PACS into one identity lifecycle. Its technical role is orchestration: when a hire, role change, or termination occurs, the same event should drive physical access decisions as well as digital ones. The article also highlights policy-based and persona-based access, which means access can be shaped by role, department, shift, assignment, or certification status rather than a simple badge yes-or-no model. That matters where facilities, contractors, and visitors are managed across multiple physical systems. Practical implication: design lifecycle workflows so one authoritative event updates every access domain, not just the easiest one to automate.

Practical implication: design lifecycle workflows so one authoritative event updates every access domain, not just the easiest one to automate.

Threat narrative

Attacker objective: The objective is to exploit cross-domain lifecycle lag so access survives in either the physical or digital environment after it should have been removed.

1. Entry occurs when an identity lifecycle event is processed in one system but not another, leaving physical or digital access active after the business relationship changes.
2. Credential abuse follows when a badge or login remains valid despite termination or role change, allowing access that should have been removed.
3. Impact is unauthorised entry into facilities or continued access to systems after offboarding, with the greatest risk appearing when both domains stay active together.

Breaches seen in the wild

• Azure Key Vault Contributor escalation 2024: Datadog found Azure Key Vault Contributor could add itself to access policies and read every secret, key and certificate in a vault.
• Stryker Microsoft Intune Wiper Attack: Compromised Microsoft Intune credentials enable wiper attack wiping 200,000 Stryker devices.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Separate control planes create separate revocation truths: When IAM and PACS are managed independently, each system can be correct inside its own boundary while the enterprise remains out of sync. That is not a tooling inconvenience, it is a governance failure that turns joiner, mover, and leaver events into partial outcomes. The implication is that identity governance must be measured by completed lifecycle propagation, not by the state of any single system.

Physical access is a first-class entitlement, not an exception to IAM: The article reinforces a point many programmes still underweight. A badge is an entitlement with lifecycle, scope, and accountability, just like an application role or cloud permission. Treating it as facilities-only access leaves IAM, IGA, and physical security teams solving different problems against the same identity record. Practitioners should govern badge access with the same seriousness they already apply to digital entitlements.

Identity lifecycle convergence is the real control objective: PIAM is valuable here because it collapses the distance between HR truth, digital entitlement truth, and physical credential truth. That convergence matters most where roles shift, contractors churn, and facilities are distributed across multiple PACS environments. The practitioner lesson is to stop asking whether IAM or PACS owns the problem and start asking whether one lifecycle model governs all access expressions.

Physical-digital entitlement drift: The article names the real failure mode clearly enough to sharpen as a concept. Access drift occurs when the same identity has different validity states in badge systems and digital systems, creating a governance gap that neither domain can see alone. That drift becomes the field’s practical benchmark for unified identity governance.

Manual propagation is a control delay, not a process nuisance: The article shows that days-long coordination between HR, IAM, and PACS is enough to create avoidable exposure. Manual lag is not simply inefficient, it extends the window in which a departed worker or contractor still has functioning access. Security leaders should treat lifecycle latency as a measurable risk metric.

From our research library:

• 69% of security leaders agree identity management must fundamentally shift to address agentic AI systems, according to the 2026 Infrastructure Identity Survey.
• Read next: NHI Lifecycle Management Guide

What this signals

Physical-digital entitlement drift: The practical problem is not that IAM and PACS exist separately, but that lifecycle events can complete in one domain and stall in the other. Security teams should expect joined-up governance to become a baseline expectation for any environment that treats badges, doors, logins, and roles as one risk surface.

The most defensible programme response is to measure propagation latency across HR, IAM, and PACS instead of assuming revocation happened because one platform said it did. That gives identity leaders a concrete way to find where manual handoffs still control the pace of offboarding.

For practitioners

• Define one authoritative lifecycle source Establish which system is authoritative for hire, move, and leave events, then map how those events must propagate to IAM and PACS without manual handoff.
• Inventory cross-domain access entitlements List digital roles, physical badges, visitor credentials, and contractor access together so offboarding reviews see the full entitlement surface instead of only one side of it.
• Automate revocation across both domains Tie termination and role-change workflows to simultaneous removal of application access and physical credentials, with exceptions tracked and approved explicitly.
• Align compliance evidence to lifecycle events Use certification records that show when access was granted, changed, or revoked across HR, IAM, and PACS, rather than rebuilding the story after an audit request.

Key takeaways

• IAM and PACS solve different halves of the access problem, but separate control planes create revocation gaps when lifecycle events do not propagate everywhere.
• The article’s core governance issue is propagation latency across badges and logins, not a lack of access policy in either system.
• PIAM is positioned as the orchestration layer that turns HR, identity, and physical access events into one governed lifecycle.

Key terms

• Physical Identity And Access Management: PIAM is the governance layer that connects HR, identity, and physical security systems so access decisions follow one lifecycle model. It aligns badge issuance, revocation, certification, and policy enforcement across facilities, contractors, and employees, reducing the gaps that appear when physical access is managed separately from digital identity.
• PACS: Physical Access Control Systems are the systems that decide whether a badge, mobile credential, or biometric token can open a door or enter a restricted area. They are access enforcement points, not lifecycle governance systems, so they can log entry events without understanding the broader employment or role context behind them.
• Identity Lifecycle Event: A business event that changes a person’s access, obligations, or record status, such as hiring, role change, or offboarding. In HR programmes, these events often drive entitlement changes and evidence requirements, so they need to be governed as part of the identity lifecycle rather than handled as isolated paperwork.
• Entitlement Drift: Entitlement drift is the slow accumulation of permissions that no longer match the original purpose, role, or workload. In cloud-native and NHI-heavy environments, it usually happens because access changes faster than review cycles, leaving organizations with more privilege than they intended.

Deepen your knowledge

NHI governance, identity lifecycle management, and workload identity security are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or programme maturity, it is worth exploring.