Topic starter
14/08/2026 6:36 pm
TL;DR: Nexis research argues that IAM systems need three linked changes: better interoperability, more useful metrics, and access reviews that work for real-world decision-making, including distributed estates and non-human identities. Access governance breaks down when reviews, data models, and measurement stay fragmented across systems.
Editorial analysis by NHI Mgmt Group, based on content published by Nexis: “From Research to Practice: Advancing Identity and Access Management at Nexis”.
Key questions
Q: What breaks when IAM interoperability is treated as a basic data exchange problem?
A: Shared identity meaning breaks first.
Q: How should organisations measure IAM effectiveness instead of just reporting activity?
A: They should tie each metric to a governance decision, a stakeholder, and an expected change in control quality.
Q: What do security teams get wrong about access reviews?
A: Teams often treat access reviews as proof of control, when they are really only a point-in-time check.
Practitioner guidance
- Clarify IAM interoperability requirements Map which identity attributes, entitlement records, and event logs must remain semantically consistent across directories, apps, and governance tools.
- Tie IAM metrics to governance decisions Define a small metric set that answers specific questions about security, compliance, and operational efficiency.
- Redesign access review workflows for decision quality Use identity grids, sensible defaults, and limits on how many revokes a reviewer must process in one session.
Bottom line: IAM research is pointing toward a more connected governance model where interoperability, measurement, and access reviews have to be designed together.
What's in the full article
Nexis's full research covers the operational detail this post intentionally leaves for the source:
- The SCIM extension work and API design principles behind interoperability
- The full list of 43 IAM metrics and how they map to goals and audiences
- The access review usability findings, including identity grids and choice defaults
- The practical discussion of identity fabric architectures and real-world validation
👉 Read Nexis's research on IAM interoperability, metrics and access reviews →
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
14/08/2026 6:43 pm
IAM interoperability is now a governance dependency, not an integration preference. When identity data is distributed across services, access decisions become only as trustworthy as the weakest translation layer between systems. The article’s SCIM extension work reflects a wider pattern: if policy meaning cannot survive movement across tools, IAM no longer behaves like a governed fabric. Practitioners should treat semantic consistency across systems as a control objective, not a nice-to-have.
A few things that frame the scale:
- Over 70% of organisations lack automated access risk analysis, user access reviews and provisioning and deprovisioning, according to Pathlock's 2025 Digital Transformation and Access Risk Report.
A question worth separating out:
Q: How can teams govern machine identities and AI agents in access reviews?
A: Teams should assign ownership, define review cadence, and include machine identities and AI agents in the same certification logic as human access, but with role-appropriate approvers. If a non-human identity can act on sensitive data, it needs a lifecycle owner and a removal path just like any other privileged account.
👉 Read our full editorial: IAM research shows interoperability, metrics, and reviews need rework