Topic starter
11/08/2026 3:25 pm
TL;DR: Identity operations often stall in a semi-async middle layer where workflows are neither truly interactive nor fully delegated, leaving teams supervising automation instead of trusting it, according to Redblock. The governance problem is not more tooling, but deciding which identity tasks belong in human-paced review and which require auditable autonomous execution.
Editorial analysis by NHI Mgmt Group, based on content published by Redblock: “Identity’s Real Problem Isn’t Tools. It’s the Semi-Async Middle Layer Where Automation Fails”.
Key questions
Q: What breaks when identity workflows live in a semi-async middle layer?
A: Identity workflows break when they are too slow for users, too brittle for automation and too opaque for reliable governance.
Q: Why do semi-automated identity processes create so much operational risk?
A: Because they stretch control across tickets, connectors, batch jobs and inbox approvals, each of which can stall or drift independently.
Q: How should security teams decide which identity controls to automate first?
A: Start with high-volume, repeatable tasks that create delay when handled manually, such as access review routing, entitlement reminders, and offboarding follow-up.
Practitioner guidance
- Separate synchronous and delegated identity tasks Classify identity work by whether it genuinely needs live human context or can be executed end to end with auditable evidence.
- Measure workflow completion as a control outcome Track whether the final access state matches the intended state, not just whether a job fired or a ticket closed.
- Harden disconnected-app execution paths Inventory the applications that still depend on UI clicks, CSV imports or brittle connector chains, then prioritise them by business criticality and governance risk.
Bottom line: Identity automation fails when organisations force every task into a semi-async layer that is neither interactive nor fully delegated.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
11/08/2026 3:34 pm
Identity’s semi-async middle is a governance design flaw, not a tooling shortfall. Organisations have spent years adding connectors, workflow engines and dashboards, yet the operational truth remains that many identity tasks are supervised rather than reliably executed. The result is a control layer that appears modern while depending on human vigilance to survive normal variance. Practitioners should treat that middle layer as a structural governance problem, not a configuration issue.
A few things that frame the scale:
- 97% of NHIs carry excessive privileges, increasing unauthorised access and broadening the attack surface, according to the Ultimate Guide to NHIs.
- 67% of organisations still rely heavily on static credentials despite the risks they pose to agentic AI deployments, according to the 2026 Infrastructure Identity Survey.
A question worth separating out:
Q: What is the difference between workflow automation and delegated identity execution?
A: Workflow automation moves steps through a process, but delegated identity execution owns the whole task from trigger to evidence. The distinction matters because a workflow can succeed while the underlying access state still drifts, whereas delegated execution must prove the intended identity change actually happened. That is the control gap semi-async systems leave behind.
👉 Read our full editorial: Identity’s semi-async middle is where automation fails