Zero Trust fails when access review and privilege data stay fragmented

At a glance

What this is: This is a Zero Trust analysis arguing that fragmented identity and access data undermines least privilege, JIT access, and review workflows.

Why it matters: It matters because IAM and NHI teams cannot verify or remove excess access at scale when entitlements are scattered across systems and lack business context.

Context

Zero Trust only works when identity data is accurate enough to answer who can access what, in what context, and with what level of risk. When permissions are split across SaaS, IaaS, data platforms, and directories, that answer becomes approximate, and least privilege turns into a reporting problem rather than an operating control.

The governance gap is not just technical inventory. Manual review workflows cannot keep pace with access drift, so stale entitlements, over-permissioned accounts, and blind spots for non-human identities accumulate into identity debt. That is why access consolidation and real-time context matter before Zero Trust can be enforced consistently.

Key questions

Q: What breaks when access data is fragmented in a Zero Trust programme?

A: Zero Trust breaks when teams cannot see the full effective access path across SaaS, cloud, and directories. Fragmentation makes it hard to tell which permissions are necessary, which are stale, and which are overbroad. The result is inconsistent enforcement of least privilege and access reviews that look complete but leave real exposure behind.

Q: Why do fragmented entitlements increase the risk of identity debt?

A: Fragmented entitlements slow down review, ownership assignment, and revocation, so access accumulates faster than governance can remove it. Identity debt grows when the organisation treats permissions as isolated records instead of one continuously managed access surface. That creates persistent exposure even when individual teams believe their local controls are working.

Q: How should security teams implement Zero Trust for non-human identities?

A: Start by inventorying every machine identity, assigning an owner, and mapping its access to a specific business function. Then apply least privilege, short-lived credentials, and revocation controls so each identity can be verified, limited, and retired on schedule. Zero Trust fails when machine access is treated as permanent infrastructure rather than governed identity.

Q: When does just-in-time access reduce risk, and when does it not?

A: JIT access reduces risk when it replaces standing privilege, expires automatically, and is tied to a specific task. It does not reduce risk when long-lived secrets, weak approval rules, or broad default roles remain in place. Temporary access only helps if the surrounding trust model also shrinks.

Technical breakdown

Why fragmented access data breaks Zero Trust enforcement

Zero Trust depends on continuously verified identity and authorization data, but enforcement becomes unreliable when entitlement records live in separate systems with different schemas and refresh cycles. A control may exist in a directory, cloud console, or SaaS admin plane, yet the security team cannot see the full effective access path end to end. Without that unified view, policy decisions are made on partial evidence, and least privilege becomes a best-effort judgment rather than a verified state.

Practical implication: unify identity-to-access telemetry before expecting Zero Trust policy decisions to hold across cloud and SaaS estates.

Why manual access reviews do not scale identity debt down

Access reviews assume reviewers can understand current privilege, assess business need, and remove unnecessary access before it becomes risk. In fragmented environments, that process slows because reviewers must reconcile technical entitlements with actual role, usage, and ownership signals. The result is that excess permissions remain in place long enough to widen attack surface, and the organisation mistakes review completion for governance effectiveness.

Practical implication: automate entitlement context and review evidence so certification becomes removal of risk, not an administrative exercise.

How non-human identities create blind spots in least privilege

Non-human identities often bypass the attention given to human accounts because they are scattered across workloads, integrations, and service tooling. Those identities can hold stale, overbroad, or orphaned permissions that do not surface in standard user-centric review queues. Zero Trust fails when the identity model stops at people and ignores machine actors that can access sensitive data and systems with persistent entitlements.

Practical implication: include service accounts, tokens, and other NHIs in the same authorization inventory and review workflow as human identities.

Threat narrative

Attacker objective: The objective is to exploit accumulated access so a single compromised identity can reach more systems and data than Zero Trust policy intended.

1. Entry occurs when an identity receives broader access than its actual task requires, often because permissions are granted for convenience across multiple systems.
2. Escalation follows when that excess access is never fully reviewed or removed, allowing privileged paths to persist in directories, cloud services, and SaaS applications.
3. Impact comes when attackers or insiders use those standing permissions to reach sensitive data, move laterally, or expand the blast radius of a compromise.

Breaches seen in the wild

• Microsoft SAS token exposure 2023: An over-permissive Azure SAS token in a Microsoft AI GitHub repo exposed 38TB, including workstation backups and Teams messages, for 3 years.
• Azure Key Vault Contributor escalation 2024: Datadog found Azure Key Vault Contributor could add itself to access policies and read every secret, key and certificate in a vault.

Read our 52 NHI Breaches Analysis report for a comprehensive view of breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Identity debt is the structural failure behind broken Zero Trust programmes. Zero Trust assumes the organisation can keep access current enough to verify continuously, but fragmented identity data makes that assumption false in practice. When permissions are scattered across SaaS, cloud, and directory systems, the programme cannot reliably distinguish necessary access from accumulated excess. The practitioner conclusion is that identity debt must be treated as a control failure, not a cleanup backlog.

Least privilege cannot be sustained without a unified access graph. Business context matters because technical entitlement names rarely reveal whether access is legitimate, excessive, or orphaned. A fragmented view forces teams to rely on manual interpretation, which scales poorly and produces inconsistent decisions across human and non-human identities. The practitioner conclusion is that context has to be bound to entitlement data before policy can be enforced consistently.

Non-human identities expose the limits of user-centric Zero Trust design. Service accounts, tokens, and integrations often sit outside human review rhythms even though they can carry sensitive access for longer periods than user sessions. That creates a blind spot in programmes that focus on authentication events but not on ongoing entitlement scope. The practitioner conclusion is that machine identities must be governed in the same authorization plane as human accounts.

Continuous access review is now a data problem before it is a governance problem. Review cadences do not remove risk if the underlying access inventory is incomplete, stale, or disconnected from actual usage. The article shows that automation is not an optimisation layer but a prerequisite for making JIT access and least privilege enforceable at enterprise scale. The practitioner conclusion is to treat access telemetry quality as part of Zero Trust maturity.

Identity-to-data relationships should be the named control concept for Zero Trust access governance. That concept captures the practical issue the article surfaces: access decisions only work when teams can connect identity, entitlement, and the data objects those entitlements reach. Without that linkage, policy becomes abstract and remediation becomes reactive. The practitioner conclusion is to measure Zero Trust progress by how well the organisation can trace access from identity to object.

From our research library:

• 90% of IT leaders say properly managing NHIs is essential for a successful zero-trust implementation, according to the Ultimate Guide to NHIs.
• By 2029, 40% of enterprises that successfully implement zero trust within cloud service provider environments will rely on the advanced visibility and control capabilities offered by CNAPP solutions.
• Read next: NHI Lifecycle Management Guide

What this signals

Identity-to-data relationships: Zero Trust governance now depends on whether teams can trace effective access from identity to object, not just whether they have authentication and segmentation in place. When that traceability is missing, least privilege becomes aspirational and remediation decisions are made on partial evidence rather than current access reality.

The practical signal for programmes is that access review quality matters more than review volume. If certification workflows cannot incorporate usage, ownership, and business context at the point of decision, the programme is measuring activity instead of control.

NIST SP 800-207 remains relevant here because the identity layer is where continuous verification either becomes enforceable or breaks down under fragmented entitlement data.

For practitioners

• Map effective access across all identity stores Build one inventory that connects SaaS, cloud, data platforms, and directories to the identities that can reach them, including object-level access where possible.
• Automate review and certification workflows Use workflow automation to surface usage, ownership, and business context so reviewers can remove unnecessary access rather than approve it by default.
• Include non-human identities in the same governance queue Bring service accounts, tokens, and other NHIs into entitlement reviews, with the same ownership and lifecycle expectations used for user access.
• Prioritise over-permissioned accounts for remediation Focus first on identities with broad or dormant privileges that cross sensitive systems, because those paths create the largest blast radius when compromised.

Key takeaways

• Zero Trust weakens quickly when entitlement data is split across cloud, SaaS, and directory systems, because no team can verify effective access end to end.
• Identity debt is the practical consequence of manual governance outrunning access growth, especially where non-human identities are left outside the review model.
• The strongest corrective action is not another policy statement but a unified access inventory that supports continuous least privilege and revocation.

Key terms

• Identity Debt: Identity debt is the accumulation of unowned, over-permissioned, or poorly governed non-human identities that security teams cannot cleanly inventory or retire. It usually grows when experimentation outruns access governance, leaving service accounts and tokens active long after their original purpose has passed.
• Effective Access: The actual permissions an identity can exercise after inheritance, nested groups, delegation, and object-level controls are evaluated. In Active Directory, effective access is more useful than direct membership because it reveals the true operational reach of a service account.
• Access Review: A formal process for confirming whether access is still needed and justified. In IAM programs, the review becomes an evidence-bearing control when decisions are recorded, scoped correctly, and traceable to the right reviewer, application owner, or auditor.
• Identity-to-Data Relationship: An identity-to-data relationship describes which users, roles, or service accounts can access which sensitive data and under what conditions. It is a governance lens that connects entitlement management to data exposure, helping teams see when access is broader than business need or too easy to misuse.

Deepen your knowledge

NHI governance, identity lifecycle management, and workload identity security are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.