Topic starter
12/06/2026 9:27 pm
TL;DR: Developer speed and security are colliding in high-velocity environments because re-authentication, tool switching, and manual access steps push engineers toward workarounds such as credential sharing and insecure key storage, according to JumpCloud. The real issue is not convenience versus control, but whether identity governance can embed least-privilege access into native development workflows without creating bypass paths.
Editorial analysis by NHI Mgmt Group, based on content published by JumpCloud: “The Best Security is the One Engineers Don’t Notice”.
Key questions
Q: What breaks when access controls create too much friction?
A: Users build workarounds, support demand increases, and security rules lose legitimacy.
Q: Why does Just-in-Time access matter for developer environments?
A: Just-in-Time access matters because it reduces the time window in which a credential or privilege can be misused.
Q: What are the signs that access governance is failing in practice?
A: The clearest signs are slow remediation, repeated rubber stamp access reviews, and missed permissions outside traditional HR linked systems.
Practitioner guidance
- Map developer access friction points Identify where repeated re-authentication, tool switching, and approval delays cause engineers to seek shortcuts in CLI, SSH, and IDE workflows.
- Embed JIT access into native workflows Move temporary, context-aware access into the tools developers already use so privilege can be granted and revoked without forcing separate security portals into the path.
- Automate access changes as roles shift Tie provisioning and revocation to role and project changes so standing access does not accumulate across fast-moving engineering teams.
Bottom line: Developer friction turns access governance into a behavioural problem because users will choose the fastest path when the secure one is burdensome.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
12/06/2026 11:33 pm
Developer friction has become an identity governance failure mode, not a productivity side effect. When secure access is slower than the work itself, engineers rationally route around controls by sharing credentials or storing keys where they should not. That is not a culture problem first. It is a governance design problem that allows the bypass path to outperform the sanctioned one. The implication is that IAM programmes must be measured by whether secure access is actually usable inside the developer workflow.
A few things that frame the scale:
- Only 44% of developers are reported to follow security best practices for secrets management, exposing a significant developer behaviour gap, according to the State of Secrets in AppSec.
A question worth separating out:
Q: How should IAM teams align developer access with operational accountability?
A: IAM teams should make access changes follow role and project changes automatically, then review whether engineers can complete routine work without separate security detours. If the answer is no, the governance model is still too detached from how the development team actually operates.
👉 Read our full editorial: Frictionless developer access is now an identity governance issue