SaaS access reviews are failing between review cycles

At a glance

What this is: This is an analysis of why point-in-time SaaS access reviews miss the period when most access drift actually occurs.

Why it matters: It matters because IAM, IGA, and PAM teams need controls that govern access continuously across human, NHI, and emerging AI agent identities, not just at audit time.

By the numbers:

• The average company now runs on 106 SaaS applications, according to BetterCloud’s State of SaaS report.
• Gartner estimates the ratio of machine identities to human identities at 82 to one.

👉 Read PlainID's analysis of why SaaS access reviews fall behind

Context

SaaS access reviews are a classic governance control, but they are built around a snapshot model that struggles in environments where permissions, integrations, and service accounts change every day. For identity security programmes, the problem is not whether a reviewer signs off correctly. The problem is that access can drift materially before the next review cycle begins.

This is where IAM, IGA, and NHI governance intersect. Human accounts still need certification, but service accounts, API-linked tokens, and AI agents can accumulate standing access outside normal HR-driven lifecycle controls. When the control only checks periodically, the environment can move long before the evidence does.

Key questions

Q: What breaks when SaaS access is not tied to lifecycle controls?

A: Access persists after the business need has ended, which means former employees, stale integrations, and unused permissions can still reach data. That breaks offboarding, weakens auditability, and leaves organisations unable to prove that access was removed when the relationship changed. SaaS governance only works when termination closes the identity path, not just the HR record.

Q: Why do SaaS environments make access certification harder to trust?

A: Because the environment changes faster than the review cadence. New apps, tokens, and delegated access can appear daily, while certification often runs quarterly or monthly. The result is that the review reflects a historical snapshot rather than current entitlement reality, which weakens its value as a governance signal.

Q: How can security teams reduce stale access in SaaS?

A: Use runtime authorization for the most sensitive applications, pair it with explicit lifecycle ownership for non-human identities, and shorten the time between entitlement change and policy enforcement. Reviews should confirm that policy remains accurate, not serve as the mechanism that eventually corrects access drift.

Q: Who is accountable when an AI agent performs an unauthorized action in a SaaS product?

A: Accountability stays with the organisation that granted the agent authority, but investigators need evidence to prove what the actor was allowed to do and what it actually did. That is why audit logs, scope controls, and session-level attribution matter across human, service, and agent activity.

Technical breakdown

Why point-in-time access certification misses SaaS drift

Access certification is an evidentiary control: it records that an owner reviewed an entitlement at a specific moment. That model works only when access changes slowly enough for the review window to matter. In SaaS environments, provisioning, offboarding, contractor expiry, and integration sprawl can all occur between review dates. The result is not failed compliance paperwork, but a control that describes past state while current state keeps moving. Review cadence becomes the bottleneck, not reviewer diligence.

Practical implication: Treat certification as assurance evidence, not as the primary mechanism that enforces access between changes.

Runtime authorization and zero standing privilege in SaaS

Runtime authorization moves the access decision from a calendar event to the moment a request occurs. Instead of relying on a role that remains active until the next attestation, policy is evaluated each time access is attempted. That aligns with Zero Standing Privilege, where no identity keeps persistent access simply because it was once approved. This is especially relevant in SaaS, where integrations, delegated access, and non-human identities often outlive the business event that originally justified them.

Practical implication: Use runtime policy checks for high-risk SaaS entitlements, especially where access can persist beyond employment or contract boundaries.

Why service accounts and AI agents widen the review gap

SaaS review processes were originally designed for human users mapped to managers and business owners. Service accounts and AI agents do not fit that rhythm neatly because they can be provisioned outside HR workflows, inherit broad scopes, and continue operating without obvious offboarding triggers. That creates governance blind spots around ownership, purpose, and expiry. If the identity subject is non-human, the question is not only whether access was approved, but whether anyone can prove it still has a valid business purpose right now.

Practical implication: Maintain separate lifecycle controls for non-human identities so reviews do not become the only place where stale access is discovered.

NHI Mgmt Group analysis

Snapshot-based review is a governance artefact, not a runtime control. Access certification proves that someone looked at permissions at one point in time, but it does not constrain what happens before or after that moment. In SaaS estates where entitlements can change daily, the control cannot close exposure windows created by delayed offboarding, integration sprawl, or scope creep. The implication is that access governance has to move from attestation to enforcement.

Standing privilege is the real failure mode behind most SaaS review programmes. The issue is not that teams fail to run reviews, but that identities keep usable access between reviews. A contractor token, a moved employee, or a newly connected AI agent can all retain permissions long enough to become an incident. Practitioners should stop treating the review cycle as the boundary of governance and start treating it as evidence collection after runtime policy has already done the enforcement work.

Zero standing privilege is the correct design target for SaaS access. Persistent grants create the exact window that attackers and negligent drift exploit. When access is evaluated at request time, the organisation reduces the amount of dormant entitlement available to be abused later. That does not eliminate reviews, but it changes their purpose from protection to verification.

Lifecycle ownership must extend beyond human joiner-mover-leaver processes. SaaS environments now contain contractors, service accounts, and AI agents that sit outside traditional employee-based governance assumptions. If no one owns their expiry, scope reduction, and offboarding, review programmes will keep rediscovering the same stale access. The practical conclusion is that identity lifecycle must be defined for every actor type, not only employees.

Runtime policy introduces the named concept of access drift debt. This article shows how unmanaged delay between entitlement change and review creates a growing debt of unaudited exposure. The debt is not visible in the report itself, which is why auditors may see a clean certification trail while the real risk sits in the days between cycles. Teams should measure and reduce that drift, not just speed up approvals.

From our research:

• 28% of secrets incidents now originate outside code repositories, in Slack, Jira, and Confluence, and are 13% more likely to be categorised as critical than code-based leaks, according to the State of Secrets Sprawl 2026.
• From our research: 64% of valid secrets leaked in 2022 are still valid and exploitable today, according to the State of Secrets Sprawl 2026.
• From our research: See Guide to the Secret Sprawl Challenge for the operational patterns that let exposure persist between governance checks.

What this signals

Access drift debt: when the period between entitlement change and governance action becomes the real security exposure, continuous policy enforcement matters more than the next quarterly review. In practice, that means identity teams should treat review lag as a measurable risk indicator, not an administrative inconvenience.

With 64% of valid secrets leaked in 2022 still valid and exploitable today, per the State of Secrets Sprawl 2026, the lesson is clear: detection without enforcement leaves usable access in place. That same logic applies to SaaS reviews, where stale entitlements can persist until the next cycle.

For teams formalising this shift, OWASP Non-Human Identity Top 10 remains a useful reference point for controlling overprivilege, rotation, and lifecycle gaps across machine-access patterns. The programme question is no longer whether access was reviewed, but whether access was still safe while it was active.

For practitioners

• Shift high-risk SaaS access to runtime policy enforcement Apply policy at request time for systems where standing access creates the biggest exposure, especially finance, CRM, HR, and support platforms.
• Separate human reviews from non-human lifecycle controls Give service accounts, integrations, and AI agents explicit ownership, expiry, and purpose tracking so they are not governed only through the employee review process.
• Measure the delay between entitlement change and review Track how long contractor exits, role changes, and integration updates remain active before policy or review catches up, then use that lag as a control metric.
• Recast access reviews as assurance evidence Use certification to validate policy and ownership, but do not let the review calendar define when access becomes safe or unsafe.

Key takeaways

• Quarterly SaaS access reviews prove diligence, but they do not control the days between reviews when most access drift occurs.
• Standing privilege, delayed offboarding, and unmanaged non-human identities are the real exposure mechanisms behind review gaps.
• Runtime authorization and explicit lifecycle ownership are the practical controls that reduce SaaS access risk before the next certification cycle.

Key terms

• Access Certification: Access certification is the periodic review of whether an identity still needs its current entitlements. For NHIs, certification is only reliable when reviewers know the identity's owner, purpose, and expiry, otherwise stale machine access can persist long after the original use case has ended.
• Runtime Authorisation: Runtime authorisation is the practice of deciding access while a task is in progress, rather than only at provisioning time. It matters for NHIs because credentials and entitlements can change risk mid-session, especially when automation or AI agents interact with sensitive systems.
• Zero Standing Privilege: A control model in which an identity does not keep persistent access unless it is actively needed. For NHIs, this means credentials and permissions are issued for a narrow task and then removed. It reduces the time window and reuse value of stolen access.
• Permission Drift: Permission drift is the gradual expansion of access beyond what was originally intended. It happens when roles, tokens, and service accounts accumulate unused rights over time, making cloud identities harder to review and more dangerous to compromise.

What's in the full article

PlainID's full article covers the operational detail this post intentionally leaves for the source:

• How the runtime authorization model is applied inside existing SaaS, IAM, and IGA environments.
• What Zero Standing Privilege means for contractor access, service accounts, and agent-driven workflows.
• How policy-based access control changes the review workflow without replacing the identity stack.
• Why the Authorization Graph matters when auditors ask for evidence of who accessed what and when.

👉 PlainID's full post covers runtime authorization, Zero Standing Privilege, and the access graph behind continuous enforcement.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM or identity governance programme, it is worth exploring.