Notifications
Clear all
Topic starter
25/08/2026 6:10 pm
TL;DR: Legacy SQL-based IAM and IGA models cannot keep pace with sprawling SaaS, multi-cloud, and non-human identities, because they fail to resolve effective permissions across billions of relationships, according to Veza. Its access graph approach makes access traceable and reviewable, but the deeper issue is that visibility without governance still leaves least privilege incomplete.
NHIMG editorial — based on content published by Veza: access graph architecture and identity security governance
By the numbers:
- Only 5.7% of organisations have full visibility into their service accounts.
- 97% of NHIs carry excessive privileges, increasing unauthorised access and broadening the attack surface.
Questions worth separating out
A: Start with a single inventory of identities, entitlements, and connected applications across your cloud estate, then segment reviews by risk and identity type.
Q: Why do non-human identities complicate least-privilege implementation?
A: Non-human identities often need persistent access for automation, integration, and orchestration, which makes least privilege harder to enforce without strong scoping and rotation.
Q: What breaks when access reviews are based only on granted permissions?
A: Reviews based only on granted permissions miss whether access was actually used, whether it was excessive, and whether it still matches the job or workload.
Practitioner guidance
- Define the effective-permission source of truth Make one system responsible for resolving inherited roles, policy overrides, and resource-based permissions into the actual action boundary used for reviews and approvals.
- Bring NHIs into the same governance workflow Inventory service accounts, tokens, certificates, and workload identities alongside human accounts, then attach ownership, review cadence, and revocation paths to each.
- Validate revocation after every access decision Require evidence that rejected access was removed from the access graph, not just marked closed in the workflow, before the review is considered complete.
What's in the full article
Veza's full article covers the operational detail this post intentionally leaves for the source:
- How the Access Graph resolves inherited roles, nested groups, and policy combinations into effective permissions
- Product update notes on remediation validation in Access Reviews and how entitlement removal is verified
- Integration coverage across SaaS, cloud, on-prem, and custom apps for teams that need implementation detail
- Examples of Open Authorization API usage for bringing homegrown applications into the access model
👉 Read Veza’s analysis of access graphs, effective permissions, and NHI governance →
Access graphs and effective permissions: what IAM teams need now?
Explore further
25/08/2026 6:11 pm
Graph fidelity is now a governance requirement, not just an architecture choice. Identity programmes increasingly fail because the data model cannot represent the access fabric they are trying to govern. When permissions are nested across cloud, SaaS, and NHI estates, a flat entitlement view produces false confidence. Practitioners should treat graph fidelity as the minimum condition for credible access governance.
A few things that frame the scale:
- 92% of organisations expose NHIs to third parties, raising concerns about supply chain security, according to Ultimate Guide to NHIs.
- Only 20% have formal processes for offboarding and revoking API keys, and even fewer have procedures for rotating them.
A question worth separating out:
Q: How can organisations prove that revoked access is really gone?
A: Use a control that checks the post-review access state against the graph or access inventory, then block closure until the entitlement is no longer effective. This is especially important for privileged and non-human identities, where stale access is often the result of incomplete downstream removal. Verification should be part of the control, not an audit sample later.
👉 Read our full editorial: Veza’s access graph reframes least privilege for NHI scale
