Topic starter
25/08/2026 6:10 pm
TL;DR: Legacy SQL-based IAM and IGA models cannot keep pace with sprawling SaaS, multi-cloud, and non-human identities, because they fail to resolve effective permissions across billions of relationships, according to Veza. Its access graph approach makes access traceable and reviewable, but the deeper issue is that visibility without governance still leaves least privilege incomplete.
Editorial analysis by NHI Mgmt Group, based on content published by Veza: “Guide - The Veza Advantage”.
By the numbers:
- Veza says it has 300+ pre-built integrations across the enterprise stack.
Key questions
Q: What breaks when IAM tools cannot resolve effective permissions?
A: Reviewers can approve or reject the wrong thing when the tool only shows assignments, not the permissions that survive inheritance and policy evaluation.
Q: Why do service accounts make least privilege harder to enforce?
A: Service accounts often run unattended, so excess privilege can persist unnoticed long after the original task has ended.
Q: How do teams know if automated access reviews are actually working?
A: Automated reviews are working when exception rates fall, reviewer overrides become rare, and access decisions are grounded in clean role definitions rather than ad hoc exceptions.
Practitioner guidance
- Map effective permissions, not just assignments Build review and audit workflows around the permissions an identity can actually exercise after inheritance, policies, and overrides are evaluated.
- Verify entitlement removal after rejection Require remediation checks that confirm a rejected access item was actually removed from the target system before closing the review.
- Bring NHI assets into the same governance flow Classify service accounts, tokens, workloads, and application identities alongside human identities so they are reviewed through one consistent access model.
Bottom line: Legacy IAM and IGA models often stop at assignments, while modern environments require resolution of effective permissions across inherited access paths.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
25/08/2026 6:11 pm
Effective permissions, not entitlement counts, are the real governance unit: Legacy IAM and IGA programmes still overvalue what was assigned instead of what can actually be executed. In cloud and SaaS environments, inheritance and policy evaluation routinely transform simple assignments into broader or narrower real-world powers. The implication is that least privilege cannot be governed from static entitlement lists alone.
A few things that frame the scale:
- 96% of security operations teams report critical blind spots, most commonly in cloud infrastructure (74%) and identity and access behaviour (67%).
A question worth separating out:
Q: How should organisations implement access governance across cloud and on-premises environments?
A: Start by defining roles, policies, and approval paths, then connect governance to provisioning, deprovisioning, access reviews, and audit reporting. The goal is to keep permissions aligned to job duty as systems change. In mixed environments, governance should sit above day to day access management so teams can detect excess privilege, enforce standards consistently, and prove compliance.
👉 Read our full editorial: Veza’s access graph reframes least privilege for NHI scale