Zero trust depends on the access model beneath it

At a glance

What this is: This is an analysis of why zero trust fails when the access baseline beneath it is inaccurate, and the article argues that least privilege must be continuously right-sized to make adaptive controls meaningful.

Why it matters: It matters because IAM, IGA, PAM, and NHI programmes all depend on a correct entitlement model before verification, policy, and context-aware controls can produce trustworthy access decisions.

By the numbers:

• 2026.

👉 Read Nexis's analysis of why zero trust depends on the access model beneath it

Context

Zero trust depends on the quality of the access model underneath it. Verification can confirm identity and policy alignment, but it cannot determine whether the entitlement should exist in the first place, which is why over-provisioned access becomes a governance problem rather than a network problem. In identity programmes, that shifts the real question to whether roles, policies, and exceptions still match operational need.

For IAM teams, that means least privilege is not a one-time design choice. It is a lifecycle issue across joiners, movers, leavers, privileged users, service accounts, and other non-human identities, because access naturally accumulates unless it is actively corrected. The article frames that gap clearly: zero trust only becomes meaningful when the baseline is continuously maintained.

That makes access administration central to zero trust, not adjacent to it. The practical challenge is keeping access current as business roles, applications, and privilege paths change faster than annual reviews can capture.

Key questions

Q: How should security teams implement zero trust when access roles change frequently?

A: They should treat entitlement accuracy as a living control. That means continuously reconciling roles, policies, and exceptions against current business need, then removing unused or inherited access before layering on stronger verification. Without that baseline, zero trust can only enforce stale permissions more consistently.

Q: Why do adaptive access controls fail when the entitlement model is weak?

A: Adaptive access can only adjust decisions around the baseline it inherits. If roles are over-provisioned or segregation of duties is broken, contextual policies merely fine-tune incorrect access rather than correcting it. The result is a more sophisticated version of the same governance problem.

Q: What breaks when least privilege is applied only at review time?

A: Least privilege becomes a snapshot rather than a control. In dynamic cloud environments, identities can gain risk, accumulate privilege, or become tied to new findings long before a periodic review occurs. By the time the review happens, the access decision may already be outdated. Continuous evaluation is what keeps the model current.

Q: How do IAM and NHI teams share responsibility for zero trust governance?

A: They should operate from one access model. Human accounts, privileged users, service accounts, and other non-human identities all contribute to the same entitlement landscape, so separate governance streams miss cross-cutting privilege drift and hidden policy conflicts.

Technical breakdown

Why verification cannot fix a broken access baseline

Zero trust verification answers whether a subject is authenticated and whether policy permits the request, but it does not validate whether the entitlement itself is appropriate. If the baseline contains excess access, verification simply authorises the wrong thing with high confidence. That is why zero trust must start with access model correctness, including role design, policy structure, and entitlement hygiene. Continuous verification is only as strong as the access state it evaluates.

Practical implication: treat entitlement accuracy as a prerequisite control, not a downstream tuning exercise.

How least privilege decays across IAM and NHI lifecycles

Least privilege weakens when access is added faster than it is removed. Human movers, privileged exceptions, service accounts, and application identities all accumulate permissions over time, especially where reviews are periodic and ownership is unclear. In NHI programmes, this often shows up as stale roles, unused keys, and broad service permissions that survive well beyond their original purpose. The control problem is lifecycle drift, not just policy design.

Practical implication: review privilege growth across human and non-human identities together, not as separate governance streams.

Why adaptive access still depends on a stable entitlement model

Adaptive access uses context such as device posture, location, and risk to adjust decisions in real time. That can tighten or relax access, but it always operates on a pre-existing baseline. If the baseline is malformed, context only optimises an already incorrect entitlement structure. In practice, this means risk-based access, ABAC, and policy engines cannot compensate for bad role engineering or weak segregation of duties.

Practical implication: validate the baseline model before expanding dynamic authorisation or contextual access controls.

Threat narrative

Attacker objective: The objective is to exploit legitimate access paths to reach more systems, data, or administrative functions than the subject should have.

1. Entry occurs through ordinary authenticated access where the subject already holds entitlements broad enough to pass verification.
2. Escalation happens when excessive privileges, stale access, or role drift allow the subject to reach systems beyond current business need.
3. Impact follows when zero trust reinforces the existing entitlement model instead of correcting it, turning policy enforcement into consistent over-authorisation.

Breaches seen in the wild

• Cisco DevHub NHI breach — IntelBroker exploited exposed Cisco credentials, API tokens and keys in DevHub.
• Coupang Signing Key Breach — Unrevoked signing key credentials expose 33.7 million records after employee offboarding failure at Coupang.

Read our 52 NHI Breaches Analysis report for a comprehensive view of breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Zero trust is an access governance model before it is a verification model. Continuous verification cannot create correct entitlement decisions if the underlying role and policy structure is already wrong. That means the programme failure is often upstream of the control everyone points to, and practitioners need to treat entitlement correctness as the primary dependency.

Least privilege is a lifecycle discipline, not a static design goal. Access expands through joiners, movers, leavers, privileged exceptions, and non-human identity sprawl. When removal and recertification lag behind provisioning, zero trust ends up enforcing a stale model rather than a current one, which is why lifecycle governance belongs inside the zero-trust conversation.

Adaptive access only becomes meaningful when the baseline is trustworthy. Risk signals, device posture, and context-aware policies can refine decisions, but they cannot repair broken role engineering or hidden segregation-of-duties conflicts. The practical conclusion is that dynamic authorisation should be built on a verified entitlement model, not used to mask its weaknesses.

Access administration is where zero trust becomes operationally real. The market often frames zero trust as a matter of perimeter replacement or policy enforcement, but this article correctly pulls the lens back to entitlement quality. For IAM, IGA, PAM, and NHI teams, the governance question is whether access is continuously correct enough for verification to be trusted.

Correct access is a named governance concept, not a vague ideal. Correct access means the current entitlement state matches role, policy, business need, and risk context at the time of decision. Once organisations accept that as the object of control, they can judge whether zero trust is protecting the right thing or simply enforcing whatever already exists.

What this signals

Zero trust programmes will increasingly be judged on entitlement accuracy, not on how often verification is performed. Teams that cannot show current role alignment, unused access removal, and policy consistency will struggle to prove that their access controls are doing more than validating drift.

Correct access: the next governance battleground is whether organisations can maintain a baseline that stays accurate across human, privileged, and non-human identities as business conditions change.

That also means identity teams should expect closer convergence between IGA, PAM, and NHI governance. The more access decisions are automated or contextual, the more important it becomes to validate the baseline that those decisions depend on.

For practitioners

• Audit entitlement correctness before expanding verification layers Map the current access model across users, privileged accounts, service accounts, and application identities, then compare it to actual business need and policy intent.
• Run continuous right-sizing on stale and excessive access Use recurring reviews and automated analysis to remove unused permissions, not just to revalidate them, so least privilege stays current as roles change.
• Tie adaptive access to a verified baseline Allow context-based decisions only after roles, policies, and segregation-of-duties checks have been validated for the target identity.
• Govern non-human identities within the same access model Include service accounts, tokens, and workload identities in the same access governance workflow as human users so privilege drift is visible across the estate.

Key takeaways

• Zero trust fails when the entitlement baseline is wrong, because verification can only approve what the access model already says is allowed.
• Least privilege decays through lifecycle drift across human and non-human identities, so periodic cleanup alone is not enough.
• Practitioners need continuous right-sizing, not just more policy enforcement, if they want adaptive access to reflect current need.

Key terms

• Correct access: The access state that matches current role, policy, and business need at the moment a decision is made. In zero trust programmes, correct access is the baseline that verification protects, and if it is wrong, the rest of the control stack simply enforces the mistake more efficiently.
• Continuous right-sizing: The ongoing removal and adjustment of entitlements so access stays aligned with current need rather than historical assignment. This is the operational discipline that keeps least privilege real across human identities, privileged access, and non-human identities as organisations change.
• Adaptive Access: A risk-based access model that changes authentication requirements based on context such as device trust, location, behaviour, and session risk. It is most useful where users move between environments quickly, because the policy can stay strict without making every login equally heavy.

What's in the full article

Nexis's full analysis covers the operational detail this post intentionally leaves for the source:

• The article's discussion of AI for access administration in the Gartner Hype Cycle for Zero-Trust Technology, 2026, and what that placement implies for programme planning
• The vendor's breakdown of how dynamic authorization combines role-, attribute-, and policy-based rules with context and risk signals
• The post's explanation of how Nexis models roles and policies across systems, including its ISPM and segregation-of-duties checks
• The article's reasoning for why continuous right-sizing is the operational mechanism behind least privilege

👉 Nexis's full post covers the access model, dynamic authorization, and continuous right-sizing details behind this argument.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.