Topic starter
06/11/2026 6:40 pm
TL;DR: Traditional identity programmes cannot keep pace with rapid change, according to READI, and an Agile Identity approach is meant to deliver incremental automation and better outcomes. The governance challenge is not speed alone but whether identity teams can modernise access and operational control without losing consistency or oversight.
Editorial analysis by NHI Mgmt Group, based on content published by READI: “Reimagining Agile Principles for Identity”.
Key questions
Q: How can identity teams modernise governance without a big-bang programme?
A: Identity teams can modernise governance by moving in governed increments, such as onboarding one application, one entitlement cluster, or one access review cycle at a time.
Q: Why do waterfall identity programmes struggle with changing applications?
A: Waterfall identity programmes struggle because applications, entitlements, owners, connectors, and data sources change faster than a fixed design can absorb.
A: Security teams should connect nonstandard applications to their identity provider through automation, then standardise access workflows around onboarding, password handling, offboarding, and multifactor enrollment.
Practitioner guidance
- Define a phased identity delivery roadmap Break the programme into small governance releases that target the most painful access, onboarding and remediation gaps first.
- Standardise onboarding data before automating Require ownership, entitlement and baseline access fields before new applications enter the onboarding queue.
- Measure backlog reduction as a control outcome Track how automation changes queue length, remediation time and access consistency, not just how many tasks were automated.
Bottom line: Identity programmes lose effectiveness when they are built for stable requirements but operated in environments that change continuously.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
06/11/2026 6:41 pm
Agile identity is a governance operating model, not a delivery slogan. Identity teams do not need more movement for its own sake. They need a way to turn fragmented access work into governed increments that can be measured, reviewed and improved. That is especially relevant where human IAM, NHI controls and application onboarding overlap, because each domain changes on a different cycle and fails in a different way. Practitioners should treat agility as a control delivery method, not a replacement for control design.
A question worth separating out:
Q: How should teams govern authorization for service accounts and other machine identities?
A: Treat machine identities as governed actors that still need explicit access decisions, logging, and review. The credential may come from the identity provider, but the allowed action set must be defined in a separate policy model that applies consistently across workloads and tenants.
👉 Read our full editorial: Agile identity still needs governance, not just faster delivery