Topic starter
11/08/2026 3:24 pm
TL;DR: Traditional RPA is brittle for disconnected enterprise apps because interface changes break recorded workflows, while computer use agents can adapt visually and support policy-bound identity execution with before-and-after verification, according to Redblock. The deeper issue is that identity governance fails when the execution layer still depends on manual tickets and unverifiable completion, not on the agentic label itself.
Editorial analysis by NHI Mgmt Group, based on content published by Redblock: “The Nuance of Automation: RPA vs Computer Use Agents”.
Key questions
Q: What breaks when disconnected applications are not brought into identity governance?
A: When disconnected applications sit outside the identity system, provisioning, review, and offboarding become inconsistent and hard to evidence.
Q: Why do disconnected apps increase identity and access risk?
A: Disconnected apps increase risk because they break the chain between authentication, entitlement management, and offboarding.
Q: How can security teams tell whether identity automation is actually closing the gap?
A: Look for whether the application itself enforces access state changes and leaves an auditable trail.
Practitioner guidance
- Map the disconnected-app backlog Identify the applications where identity changes still depend on tickets, spreadsheets, or manual console work, then rank them by access criticality and remediation pain.
- Require state verification after execution For every joiner, mover, leaver, or privileged access change, confirm the target account state in the application and retain evidence of the before-and-after result.
- Separate workflow approval from completion Redesign identity operations so approval, execution, and verification are distinct checkpoints instead of a single assumed outcome.
Bottom line: Disconnected applications expose the point where IAM approval logic stops and real enforcement begins.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
11/08/2026 3:34 pm
Identity governance fails at execution when the control plane cannot prove the target state. Approval workflows are not the same as lifecycle completion, and disconnected applications expose that mismatch. The governance decision may be correct, but without verified enforcement in the application, the control is incomplete. Practitioners need to stop treating execution as an administrative afterthought.
A few things that frame the scale:
- 97% of NHIs carry excessive privileges, increasing unauthorised access and broadening the attack surface, according to the Ultimate Guide to NHIs.
- 67% of organisations still rely heavily on static credentials despite the risks they pose to agentic AI deployments, according to the 2026 Infrastructure Identity Survey.
A question worth separating out:
Q: What should IAM teams do first when moving from manual tickets to automation?
A: Start by documenting the lifecycle events that should trigger access changes, then assign ownership for each rule. That makes it possible to automate safely without guessing which requests are low risk and which need human review. Early clarity prevents workflow sprawl later.
👉 Read our full editorial: Computer use agents and the identity execution gap in IAM