Unified identity control planes are now a governance requirement

At a glance

What this is: This analysis argues that enterprise identity breaks when siloed IAM tools cannot coordinate policy, telemetry, and authorization in real time.

Why it matters: It matters because IAM, PAM, IGA, and NHI teams increasingly govern the same access event through different consoles, which creates blind spots for service accounts, AI agents, and human users alike.

By the numbers:

• A typical enterprise identity stack uses 11 tools for workforce identity security, increasing operational complexity and policy drift.

👉 Read Newcore's analysis of fragmented identity stacks and runtime authorization

Context

Enterprise identity security is no longer just about login and access review. The core problem is that identity governance, authorization, privileged access, and non-human identity controls are still split across separate tools that do not share context fast enough to keep up with modern execution patterns.

Newcore's argument is that this fragmentation becomes more dangerous once AI agents and service accounts enter the picture. A human-paced IAM model can tolerate delayed reconciliation, but machine-speed identity decisions cannot wait for batch syncs, separate consoles, or manual policy duplication.

The starting position described here is not unusual. Many enterprises still operate with disconnected identity tooling, inconsistent policy enforcement, and unclear ownership across IdP, PAM, IGA, and NHI workflows.

Key questions

Q: What breaks when identity signals are analysed in separate consoles?

A: What breaks is causal reconstruction. Analysts can see individual anomalies, but they lose the order that shows how one event led to the next, which makes it harder to distinguish normal user activity from an attack path that is spreading across systems.

Q: Why do AI agents and NHIs require runtime authorization?

A: Because their work can happen faster than batch governance cycles. If an agent can complete thousands of actions in seconds, a once-per-session approval is already stale. Runtime authorization evaluates the specific action in the current context, which is the only control that matches machine-speed behaviour.

Q: What do IAM teams get wrong about unified identity platforms?

A: They often assume aggregation alone solves governance. In reality, a platform only helps if it can support review, correlation, and action across the full lifecycle of the identity. Without that, the organisation gets a cleaner dashboard, not materially better control.

Q: Why do service accounts and AI agents need different controls from human users?

A: Service accounts and AI agents authenticate and act without the predictable patterns that human identity systems expect. They can operate across runtimes, scale quickly, and carry permissions into automated workflows. That means access decisions should consider workload context, runtime behaviour, and time-bound authority rather than relying only on user-centric IAM patterns.

Technical breakdown

Why siloed IAM consoles create policy drift

Modern IAM estates often split authentication, authorization, governance, and privileged access into separate control planes. Each system keeps its own policy language, event model, and workflow timing, so a role change or privilege escalation can exist in one console without being visible in another. That creates a reconciliation problem, not just an administration burden. When one tool sees the user, another sees the vault, and a third sees recertification state on a batch timer, the enterprise never gets a single authoritative answer about current access.

Practical implication: map where the same access decision is duplicated across consoles and remove any policy path that depends on delayed synchronization.

How machine-speed identities break human-speed authorization

AI agents and some non-human identities can act in bursts, generating large numbers of API calls in very short windows. That changes the meaning of session length, because the exposure window may be measured in seconds rather than hours. Static authorization assumes the risk state is stable long enough to evaluate once and cache. Runtime authorization instead evaluates the current action, current context, and current behavior at the moment of execution, which is the only way to keep pace with machine-speed activity.

Practical implication: identify which identities can complete sensitive work before your governance tooling would normally refresh state.

What a unified control plane changes for identity governance

A unified control plane does not eliminate IAM, PAM, or IGA functions. It changes how they relate to one another by letting authentication, authorization, and governance share the same event and policy context. That matters for NHI because service accounts, tokens, and AI agents often cross multiple systems during one workflow. Without shared telemetry, one tool can approve, another can escalate, and a third can miss the drift entirely. The technical issue is not tool count alone. It is the absence of a common runtime decision layer.

Practical implication: prioritise architectures that let governance and runtime enforcement consume the same identity event stream.

Threat narrative

Attacker objective: The attacker aims to move through disconnected identity controls long enough to escalate privileges and operate without synchronized detection.

1. Entry occurs when attackers exploit identity stack fragmentation through helpdesk social engineering or synchronized policy gaps, gaining a foothold in one control layer without immediate visibility in the others.
2. Escalation follows when privilege drift in a target application is not reflected back into governance tools, allowing unauthorized administrative access to persist until the next batch reconciliation.
3. Impact lands when the lack of real-time telemetry across IdP, PAM, and IGA prevents timely containment, extending attacker dwell time and widening the blast radius.

Breaches seen in the wild

• Cisco DevHub NHI breach — IntelBroker exploited exposed Cisco credentials, API tokens and keys in DevHub.
• Meta AI Instagram Account Takeover — 20,225 Instagram accounts hijacked via compromised Meta AI support chatbot with overprivileged access.

Read our 52 NHI Breaches Analysis report for a comprehensive view of breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Identity silos are now a structural access-control problem, not an IT admin inconvenience. When authentication, governance, and privileged access sit in separate consoles, the enterprise cannot prove that one current decision applies everywhere. The result is policy drift by design, because each tool evaluates a different slice of the identity state. Practitioners should treat this as a control architecture issue, not a dashboard problem.

Runtime authorization has become the only credible response to machine-speed identity behaviour. Human-paced recertification assumes access persists long enough to be reviewed, but AI agents and fast-moving NHIs can complete sensitive work inside a single short session. That shifts the governance question from periodic approval to moment-of-action evaluation. Teams should reframe access control around execution time, not calendar time.

Unified identity control planes will increasingly define the market for NHI and agentic AI governance. The category is moving away from point products that cover one layer well and toward platforms that can share context across authentication, privilege, and governance. That does not make specialist tools obsolete, but it does raise the bar for interoperability. Practitioners should expect vendor selection to turn on runtime context sharing rather than feature count.

Runtime authorization: the real governance gap is not whether an identity has permission at onboarding, but whether the permission still makes sense when the action is attempted. This breaks the old assumption that access can be validated once and reused safely across a session. The implication is that policy design must account for change during execution, not only before it.

The same fragmentation that weakens human IAM also magnifies NHI risk. Service accounts and tokens often inherit policies from different systems, which makes offboarding, rotation, and privilege reduction difficult to prove end to end. When an enterprise cannot reconcile identity state across tools, it also cannot demonstrate who or what should still have access. Practitioners should expect NHI governance to fail first where control ownership is split.

From our research:

• Only 5.7% of organisations have full visibility into their service accounts, according to Ultimate Guide to NHIs.
• A separate finding shows that 97% of NHIs carry excessive privileges, which means visibility gaps quickly become privilege governance gaps.
• For a deeper lifecycle lens, Ultimate Guide to NHIs , Lifecycle Processes for Managing NHIs shows how provisioning, rotation, and offboarding need to stay connected.

What this signals

Identity convergence will become a governance requirement rather than an architecture preference. As AI agents and service accounts take on more operational work, enterprises will need one control model that can reason across authentication, privilege, and lifecycle state. The practical next step is to align IAM, PAM, and NHI ownership before the next wave of automation expands the gap.

Service-account visibility is the first place most programmes will feel the pressure. With only 5.7% of organisations reporting full visibility into their service accounts, hidden entitlements will remain the default failure mode unless inventory, ownership, and revocation are tied together. Teams should expect audit questions to shift from whether controls exist to whether they can prove current state.

Runtime governance will increasingly sit alongside zero trust instead of underneath it. NIST Cybersecurity Framework and Zero Trust architectures both assume continuous verification, but identity programmes still often verify too slowly for machine-speed actors. The organisations that close this gap will treat runtime policy as part of access architecture, not an afterthought.

For practitioners

• Map duplicated identity decisions across tools Identify where the same role change, privilege grant, or revocation is handled in IdP, PAM, and IGA separately. Remove workflow steps that depend on manual re-entry or overnight reconciliation.
• Shorten the authorization review window Find identities that can complete sensitive actions before governance state refreshes, especially service accounts and AI agents. Move those paths to runtime evaluation instead of cached session approvals.
• Unify identity telemetry before expanding AI access Require shared event visibility across authentication, authorization, and governance before granting broader access to agents or workloads. If the tools cannot see the same state, they cannot enforce the same policy.
• Rebuild offboarding around all identity types Test whether leaver processes, key revocation, and privilege reduction work across humans, service accounts, and agents with the same traceability. If not, the control gap is organizational, not technical.
• Use the 52 NHI Breaches Analysis to pressure-test gaps Compare your control failures against documented breach patterns where unmanaged secrets, privilege drift, and delayed revocation enabled access to persist.

Key takeaways

• The article's core warning is that fragmented identity tooling creates policy drift across humans, service accounts, and AI agents.
• Newcore's evidence points to machine-speed access as the breaking point, because static governance cannot keep up with short-lived but high-impact activity.
• The practical response is to move toward shared identity state and runtime authorization before more access paths become ungovernable.

Key terms

• Identity Control Plane: An identity control plane is the governance layer that decides who or what can access systems and under what conditions. In practice, it coordinates authentication, authorization, privilege review, and lifecycle management across human and machine identities so access policy is enforced consistently across environments.
• Runtime Authorisation: Runtime authorisation is the practice of deciding access while a task is in progress, rather than only at provisioning time. It matters for NHIs because credentials and entitlements can change risk mid-session, especially when automation or AI agents interact with sensitive systems.
• Scope drift: Scope drift is the gradual mismatch between what an integration was meant to do and what its credentials still allow it to do. It happens when permissions are not revalidated as business needs change, creating hidden over-privilege across SaaS and API-connected systems.
• Machine-speed identity: An identity pattern where actions, approvals, and downstream effects occur faster than human review cycles can comfortably observe or interrupt. It matters because security controls built for human latency can become ineffective when execution is compressed into seconds or less.

What's in the full article

Newcore's full analysis covers the operational detail this post intentionally leaves for the source:

• The step-by-step identity stack breakdown across IdP, PAM, IGA, NHI, and authorization engines.
• The runtime authorization comparison between static session checks and continuous decisioning.
• The practical examples of how policy drift appears across Okta, SailPoint, and CyberArk workflows.
• The real-world enterprise bandwidth problem created by managing multiple disconnected identity consoles.

👉 Newcore's full post covers the identity control plane model, machine-speed access, and the operational cost of silos.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.