Zero trust depends on the access model beneath it

At a glance

What this is: This analysis argues that zero trust fails if the access model beneath it is wrong, because verification will faithfully approve whatever entitlements already exist.

Why it matters: For IAM, IGA, and NHI programmes, the issue is not just enforcing access at runtime but proving the baseline is least privilege before continuous verification is applied.

👉 Read Nexis's analysis of why zero trust depends on the access model beneath it

Context

Zero trust is a security model that assumes access should be verified continuously, but that verification still depends on a correct entitlement baseline. If the roles, policies, and permissions underneath it are already over-provisioned, the model will enforce the wrong access with precision instead of preventing it.

The governance gap is not verification itself. The problem is access right-sizing across joiner, mover, and leaver changes, policy drift, and cross-application inconsistencies, which are the conditions that make least privilege hard to sustain in practice.

Key questions

Q: What breaks when zero trust is built on an over-provisioned access model?

A: The model still verifies access, but it verifies the wrong access with high confidence. Zero trust cannot correct entitlement inflation if roles and policies already allow more than a user should have, so the failure sits in baseline design rather than the verification step.

Q: Why does access right-sizing matter before continuous verification?

A: Because verification can only evaluate what the policy and entitlement model already allow. If the baseline is stale, continuous checks simply enforce inherited excess, which leaves least privilege as a theoretical goal instead of an operational state.

Q: What are the signs that entitlement drift is weakening zero trust?

A: The main signs are growing exceptions, permissions that outlive role changes, and access reviews that repeatedly confirm the same excess entitlements. When those patterns persist, the issue is not the verification layer but the access model underneath it.

Q: How should teams balance adaptive access with least privilege?

A: Use contextual controls to refine decisions only after the underlying roles and policies have been cleaned up. Adaptive access is most defensible when it operates on a current baseline, because context cannot repair a structurally incorrect entitlement model.

Technical breakdown

Why continuous verification cannot fix a flawed access baseline

Zero trust verification checks whether a request is authorised under policy, not whether the entitlement should exist in the first place. That distinction matters because an over-provisioned role still passes policy checks if the policy is built around the wrong baseline. In other words, continuous verification is a control over access execution, while entitlement design is a control over access definition. If the definition is stale, the enforcement layer simply repeats the mistake at scale.

Practical implication: Practitioners need entitlement governance before relying on runtime verification to reduce risk.

How least privilege erodes across roles and policy drift

Least privilege rarely fails in a single event. It erodes as users move between roles, accumulate exceptions, and retain access that is no longer required after organisational change. Policy drift then compounds the problem when business rules and technical entitlements no longer match. The result is an access model that looks governed on paper but contains hidden excess across systems. Zero trust cannot correct that drift on its own because it assumes the baseline is already meaningful.

Practical implication: Identity teams should treat right-sizing as an ongoing governance process, not a cleanup exercise.

Why adaptive access still depends on a trusted entitlement model

Adaptive access uses context such as device posture, location, and risk signals to change decisions at runtime. That makes the access decision more responsive, but it does not replace the need for a sound baseline. Context can narrow or expand access only within the boundaries of the model it inherits. If the underlying roles and policies are inconsistent, adaptive controls become a refinement layer on top of bad structure rather than a compensating control.

Practical implication: Teams should validate the entitlement model before expecting contextual access controls to improve outcomes.

NHI Mgmt Group analysis

Zero trust inherits the quality of the access model beneath it. Verification can only confirm that policy allows a request, not whether the request reflects least privilege. When the entitlement baseline is wrong, zero trust becomes a high-confidence enforcement layer for bad decisions, which is why access model governance sits upstream of every runtime control.

Continuous right-sizing is the real zero-trust control plane. The article correctly shifts attention from network perimeter language to the sustained management of roles, policies, and entitlements. That aligns with how access actually changes in enterprise environments: gradually, unevenly, and across multiple systems. Practitioners should treat entitlement hygiene as the operational foundation of zero trust, not as a side activity.

Access administration is the point where identity governance and zero trust meet. The strategic issue is not whether organisations can verify users, but whether they can define correct access quickly enough to keep pace with organisational change. This is where IAM and IGA discipline becomes the difference between adaptive control and adaptive overreach, especially across complex estates.

Right-sizing access is a governance problem, not a point-in-time review problem. Over-provisioning accumulates through joiner, mover, and role-change events, then survives because review cycles are slower than business change. The practical conclusion is that zero trust only remains credible when entitlement management is continuous enough to keep the baseline aligned with reality.

Named concept: entitlement baseline integrity. The article points to a simple but under-discussed requirement: zero trust depends on the integrity of the access baseline before any contextual or behavioural controls are applied. Without that integrity, least privilege becomes aspirational language rather than an enforceable state. Practitioners should frame zero trust programmes around baseline accuracy first, not verification sophistication.

From our research library:

• 90% of IT leaders say properly managing NHIs is essential for a successful zero-trust implementation, according to the Ultimate Guide to NHIs.
• Read next: Zero Trust Identity Guide

What this signals

Entitlement baseline integrity: Zero trust only stays meaningful when the access model beneath it is current, because runtime verification cannot distinguish a legitimate entitlement from an over-provisioned one. That makes entitlement accuracy a governance requirement, not a tuning exercise, for IAM and IGA teams.

The practical signal for programme owners is that access reviews alone are not enough if role design, mover handling, and policy alignment are drifting in the background. Teams should watch for systems where adaptive access is active but entitlement sprawl still grows, because that is where zero trust becomes performative rather than corrective.

For practitioners

• Establish entitlement baseline governance Map roles, policies, and inherited permissions to the access that should exist today, not the access that accumulated over time. Focus first on roles with the highest volume of mover events and the widest entitlement spread.
• Automate continuous access right-sizing Use recurring analysis to flag unused, excess, or conflicting access before it becomes normalised across systems. Treat right-sizing as an operational control with owners, thresholds, and escalation paths.
• Validate contextual controls against a clean baseline Check that adaptive access decisions are being made on top of current, least-privilege entitlements rather than inherited sprawl. If the baseline is stale, the contextual layer only decorates the problem.
• Separate verification from entitlement design Review which controls prove identity or policy compliance at request time and which controls define the correct access model in the first place. Do not let runtime approval substitute for entitlement correctness.

Key takeaways

• Zero trust is only as accurate as the access model it inherits, so verification cannot rescue a flawed entitlement baseline.
• Over-provisioned access, policy drift, and role churn are the real reasons least privilege erodes in mature environments.
• The decisive control is continuous access right-sizing, because adaptive enforcement is only meaningful when the starting model is already correct.

Key terms

• Entitlement Baseline: An entitlement baseline is the expected access footprint for a role, team, or job function. It gives reviewers a reference point for spotting excess access, but it only works if the baseline is updated for real work patterns and not treated as a static job title checklist.
• Permission Right-Sizing: The process of reducing an identity's access to only what it actually uses. For non-human identities, this depends on usage telemetry, dependency mapping, and continuous review because permissions drift as workloads and integrations change.
• Adaptive Access: A risk-based access model that changes authentication requirements based on context such as device trust, location, behaviour, and session risk. It is most useful where users move between environments quickly, because the policy can stay strict without making every login equally heavy.
• Least Privilege: A security principle requiring that every identity, human or non-human, is granted only the minimum permissions necessary to perform its function. Least privilege is the single most effective control for reducing NHI blast radius.

What's in the full article

Nexis's full article covers the operational detail this post intentionally leaves for the source:

• How the NEXIS Platform models roles and policies across systems
• How NEXIS ISPM identifies unused access and supports removal workflows
• How cross-application segregation-of-duties checks are applied across business and administrative systems
• How dynamic authorization combines role-, attribute-, and policy-based rules with context and risk signals

👉 The full Nexis article covers role modelling, continuous right-sizing, and dynamic authorization in more operational detail.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.