TL;DR: Legacy SQL-based IAM and IGA models cannot keep pace with sprawling SaaS, multi-cloud, and non-human identities, because they fail to resolve effective permissions across billions of relationships, according to Veza. Its access graph approach makes access traceable and reviewable, but the deeper issue is that visibility without governance still leaves least privilege incomplete.
At a glance
What this is: This is an analysis of how access graphs change the way teams resolve effective permissions, with Veza arguing that relational IAM models cannot keep up with modern identity sprawl.
Why it matters: It matters because IAM, IGA, PAM, and NHI programmes all depend on knowing not just who has access, but what access actually resolves to across inherited roles, policies, and nested entitlements.
By the numbers:
- Veza says it has 300+ pre-built integrations across the enterprise stack.
Context
Access governance breaks down when tools can list entitlements but cannot resolve what those entitlements mean in practice. In modern environments, effective permissions are shaped by identity providers, inherited roles, conditional policies, resource policies, and platform-specific overrides, which makes simple group or role reporting incomplete.
The article is fundamentally about NHI and broader identity governance at scale. Veza positions its access graph as a way to unify people, service accounts, workloads, and application access so teams can answer who can do what on what data without treating every system as an isolated island.
Key questions
Q: What breaks when IAM tools cannot resolve effective permissions?
A: Reviewers can approve or reject the wrong thing when the tool only shows assignments, not the permissions that survive inheritance and policy evaluation. That creates governance drift, where the record says access was reviewed but the runtime state still allows actions the reviewer never saw.
Q: Why do service accounts make least privilege harder to enforce?
A: Service accounts often run unattended, so excess privilege can persist unnoticed long after the original task has ended. They also accumulate permissions through integrations, automation, and vendor workflows that are easy to overlook in manual reviews. That makes lifecycle control and visibility more important than the account type itself.
Q: How do teams know if automated access reviews are actually working?
A: Automated reviews are working when exception rates fall, reviewer overrides become rare, and access decisions are grounded in clean role definitions rather than ad hoc exceptions. If certifications keep surfacing the same noisy entitlements, the problem is usually role design, not reviewer effort. Effective automation should reduce ambiguity, not scale it.
Q: How should organisations implement access governance across cloud and on-premises environments?
A: Start by defining roles, policies, and approval paths, then connect governance to provisioning, deprovisioning, access reviews, and audit reporting. The goal is to keep permissions aligned to job duty as systems change. In mixed environments, governance should sit above day to day access management so teams can detect excess privilege, enforce standards consistently, and prove compliance.
Technical breakdown
Why relational IAM models stop at entitlement fragments
Traditional IAM and IGA platforms were built around relational data structures that are efficient for tabular records, but weak at traversing dense permission graphs. In an enterprise access fabric, identities connect to groups, roles, policies, and resources through many-to-many relationships that must be walked recursively to determine the true path of access. That means a report can say a user or service account belongs to a role, yet still miss how inheritance, nesting, and policy evaluation change the final decision. Graph databases are designed for these traversals because they optimise relationship queries rather than row joins.
Practical implication: Practitioners should assume entitlement inventory is incomplete unless the control model can traverse inherited access paths end to end.
How effective permissions are calculated across cloud and SaaS
Effective permissions are the actual actions an identity can take after all policies, conditions, overrides, and inherited entitlements are evaluated together. Cloud platforms frequently combine identity-based policy, resource-based policy, trust relationships, and environment-specific checks before allowing an action such as create, read, update, or delete. That is why a role assignment alone does not equal usable access. The operational challenge is that different platforms resolve permissions differently, so governance tools need a normalised interpretation layer if they are to support review, audit, and remediation across AWS, Azure, GCP, and SaaS applications.
Practical implication: Teams should validate governance decisions against effective permissions, not stop at raw role or group membership.
Why access reviews fail when they do not verify revocation
An access review is only meaningful if rejection actually removes the entitlement that was reviewed. The article highlights remediation validation as a governance step because otherwise review workflows can become paperwork over stale access. In NHI environments this is especially important, since service accounts, tokens, workloads, and delegated identities often sit outside the human-centric assumptions baked into legacy certification workflows. If the downstream entitlement remains active after rejection, the governance record says one thing while the runtime access state says another.
Practical implication: Security teams should test whether review outcomes trigger verified entitlement removal, not just a workflow status change.
Breaches seen in the wild
- MongoBleed breach: MongoBleed exposed secrets across 87K MongoDB servers.
- Firebase misconfiguration exposure 2024: Missing Firebase security rules on 916 websites exposed 125 million user records and 19.87 million plaintext passwords; a quarter were fixed.
Read our 52 NHI Breaches Analysis report for a comprehensive view of breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Effective permissions, not entitlement counts, are the real governance unit: Legacy IAM and IGA programmes still overvalue what was assigned instead of what can actually be executed. In cloud and SaaS environments, inheritance and policy evaluation routinely transform simple assignments into broader or narrower real-world powers. The implication is that least privilege cannot be governed from static entitlement lists alone.
Access graphs solve a visibility problem, but visibility is not governance: A complete graph can explain how access was granted and where it flows, which is necessary for scale. But explanation does not equal control unless the result is tied to review, revocation, and verified remediation. The practical conclusion is that identity programmes need both relationship visibility and enforcement evidence.
Non-human identities now expose the weakest assumptions in access models: Service accounts, workloads, tokens, and delegated automation are no longer edge cases that can be forced through human review patterns. They behave differently, scale faster, and are often distributed across systems that legacy IGA treats separately. That means NHI governance has to be first-class, not an afterthought attached to human identity processes.
Visibility without lifecycle validation creates audit comfort, not least privilege: The article’s strongest governance point is the rejection-to-removal loop. If a review can reject access but cannot prove the entitlement disappeared, the control is informational rather than authoritative. Practitioners should treat verified revocation as the benchmark for credible identity governance.
Access graphs create a useful operating model for modern identity programmes: The most valuable shift is not the database shape itself, but the ability to unify identity and permission metadata across cloud, SaaS, and on-prem systems. That allows governance teams to reason about access as a living relationship rather than a static record. The practical implication is that IAM architecture should be judged by decision quality, not just inventory breadth.
From our research library:
- 96% of security operations teams report critical blind spots, most commonly in cloud infrastructure (74%) and identity and access behaviour (67%).
- Read next: Access Reviews and Certification Guide
What this signals
Access graphs change the control point: once teams can trace effective permissions, the debate shifts from visibility to governance evidence. That matters because access review programmes built around group membership will miss the real decision boundary in multi-policy environments.
NHI governance becomes first-class when permissions are resolved, not inferred: service accounts and workloads should not be managed as exceptions that sit outside review logic. If your programme cannot reconcile inherited access paths for machine identities, least privilege remains partial even when inventories look complete.
Cloud and SaaS environments are forcing identity teams to treat permission resolution as a programme design requirement rather than a reporting enhancement. The practical watch-out is simple: if remediation is not verified, access review outcomes are only claims, not controls.
For practitioners
- Map effective permissions, not just assignments Build review and audit workflows around the permissions an identity can actually exercise after inheritance, policies, and overrides are evaluated.
- Verify entitlement removal after rejection Require remediation checks that confirm a rejected access item was actually removed from the target system before closing the review.
- Bring NHI assets into the same governance flow Classify service accounts, tokens, workloads, and application identities alongside human identities so they are reviewed through one consistent access model.
- Normalize access data across source systems Unify IdP, cloud, SaaS, and on-prem permission metadata so inherited access paths can be traced without treating each platform as an isolated silo.
Key takeaways
- Legacy IAM and IGA models often stop at assignments, while modern environments require resolution of effective permissions across inherited access paths.
- The article argues that access graphs help make hidden permission chains visible, but visibility only matters when remediation is verified.
- For practitioners, the key issue is whether governance workflows can prove that rejected access was actually removed from the target system.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 and MITRE ATT&CK address the attack and risk surface, while NIST SP 800-53 Rev 5 and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-05 — Overprivileged NHI | The article focuses on calculating and reducing excess effective permissions across NHIs and related identities. |
| NHI-01 — Improper Offboarding | Remediation validation matters because rejected access must actually disappear, especially for machine identities. | |
| Recommendation — Map effective permissions for each NHI and remove access that exceeds the task requirement. Verify that access revocations complete cleanly for NHIs before closing governance records. | ||
| NIST SP 800-53 Rev 5 | IA-5 — Authenticator Management | The article's governance gap includes validation that entitlements and authenticators are actually removed. |
| Recommendation — Apply IA-5 to enforce lifecycle control over non-human authenticators and their revocation. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | Effective permissions are the core subject, making entitlement governance directly relevant. |
| Recommendation — Use PR.AA-05 to govern entitlements by their real authorization outcomes, not raw assignments. | ||
| MITRE ATT&CK | TA0006;TA0008 — Credential Access; Lateral Movement | Overprivileged access paths and hidden inheritance are common enablers of credential abuse and movement. |
| Recommendation — Map exposed access paths to credential access and lateral movement opportunities in your detection and review process. | ||
Key terms
- Effective Permissions: Effective permissions are the access an identity can actually use after role inheritance, scope, and policy are applied. In Azure AI environments, they often matter more than the assigned role name because inherited rights can widen access to data, logs, and secret stores.
- Access Graph: An access graph is a relationship model that links identities, permissions, data objects, and system interactions. In NHI governance, it helps security teams see the full path from an agent or user to the action it can take, which is more useful than isolated account reviews.
- Validated remediation: Validated remediation means proving that a patch, configuration change, or mitigation actually closed the attack path. The key test is not whether the change was deployed, but whether the environment now blocks, detects, or otherwise neutralises the technique that made the issue dangerous.
Deepen your knowledge
NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.
Published by the NHIMG editorial team on August 25, 2026.
Updated on October 7, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org