Topic starter
25/06/2026 1:08 am
TL;DR: Identity-only access models still leave overprivileged accounts, manual approvals, and weak device or session checks exposed to misuse, according to Apono’s analysis of context-aware access control. Static identity signals are no longer enough to govern JIT, JEP, and privileged access in cloud-native environments, where environment and intent now shape the real security decision.
Editorial analysis by NHI Mgmt Group, based on content published by Apono: “Identity Is NOT the New Perimeter, Context Is (Just Ask Security Vendors)”.
Key questions
Q: What breaks when identity controls focus only on authentication?
A: Authentication-only programmes miss the point where most modern attacks succeed: after a valid login.
Q: Why does context reduce risk in just-in-time access workflows?
A: Context reduces risk because it lets the system decide whether temporary access is appropriate at the moment of request, rather than assuming all requests from an approved identity are equal.
Q: What are the signs that approval-based access is failing?
A: The main signs are slow access grants, repeated exceptions, broad privileges that stay in place after the task ends, and reviewers approving requests without the signals needed to judge risk.
Practitioner guidance
- Define contextual access signals Map which signals must influence access for privileged workflows, including device health, location, time, resource sensitivity, and workflow state.
- Reduce standing privilege Use JIT and JEP to replace broad always-on privileges where the task is temporary or narrowly scoped.
- Move approvals to exception paths Reserve manual approval for unusual cases that cannot be resolved by contextual policy.
Bottom line: Identity alone is not sufficient to govern modern access decisions because the surrounding context often determines the real risk.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
25/06/2026 10:20 am
Context is now the governance variable that decides whether identity has any security value at all. Static identity signals still matter, but they no longer describe the risk state of the request. Device posture, session behaviour, location, and workflow context determine whether access is appropriate in the moment, which means access governance has moved from identity verification to request evaluation.
A question worth separating out:
Q: Should teams replace manual approval with contextual policy for privileged access?
A: Yes, where the request can be judged from policy inputs such as device health, location, time, and resource sensitivity. Manual approval still has a place for exceptions, but it should not be the main control for routine privileged access. Otherwise the organisation pays a delay tax without gaining better security decisions.
👉 Read our full editorial: Context-aware access is replacing identity-only perimeter thinking