Notifications
Clear all
Topic starter
11/07/2026 1:55 pm
TL;DR: As SaaS, AI tools, and unmanaged devices proliferate, organisations lose visibility across apps and logins, creating access blind spots that traditional SSO and spreadsheet-driven governance cannot reliably close, according to Drata’s partner perspective with 1Password. The core issue is not just more access, but fragmented trust decisions across identities, devices, and workflows that identity programmes now have to govern.
NHIMG editorial — based on content published by Drata: a partner perspective on access challenges and device trust with 1Password
Questions worth separating out
A: They should treat access as a continuous decision, not a one-time login event.
Q: Why do unmanaged devices create a governance gap for IAM and compliance teams?
A: Unmanaged devices break the assumption that identity alone is enough to establish trust.
Q: What do security teams get wrong about shadow access in SaaS environments?
A: They often assume the identity platform already has the full picture.
Practitioner guidance
- Inventory all non-SSO access paths Document every SaaS login, delegated connection, and AI tool access path that bypasses central SSO so you can assign a control owner and review cadence to each one.
- Make device posture a pre-access condition Require validated device status before access is granted to sensitive applications, including checks for managed status, security tooling, and compliance state.
- Bring AI agents into identity governance Register AI agents and other non-human identities as governed actors, then attach owners, access scopes, and review workflows to their runtime permissions.
What's in the full article
Drata's full partner perspective covers the operational detail this post intentionally leaves for the source:
- How the Drata and 1Password Device Trust integration maps device checks into continuous compliance evidence.
- Which device controls are being validated before access is granted, including posture and security tooling signals.
- How automated self-remediation reduces access disruption when devices fall out of compliance.
- Where the partner model claims to reduce manual evidence collection across security and audit workflows.
👉 Read Drata's partner perspective on closing the access-trust gap with 1Password →
Hidden access and device trust gaps: what security teams are missing?
Explore further
11/07/2026 2:05 pm
Access trust has become a policy problem, not just an authentication problem. The article’s core signal is that organisations are no longer failing at login alone, they are failing at deciding what should be trusted after login. Once SaaS, unmanaged devices, and AI tools expand the access surface, static policy boundaries collapse. The practical conclusion for IAM and IGA teams is that trust decisions must follow the session, not sit only at the perimeter.
A question worth separating out:
Q: Who is accountable when AI agents or other non-human identities access sensitive systems?
A: Accountability should sit with the system owner or business owner responsible for the agent, not with a vague platform team. AI agents need named ownership, defined scopes, and reviewable logs because they can act independently within their permissions. If no owner is assigned, the identity is effectively unmanaged.
👉 Read our full editorial: Hidden access and device trust gaps are widening in SaaS and AI
