Topic starter
25/06/2026 12:49 am
TL;DR: IDQL and Hexa propose a vendor-neutral way to express, translate, and orchestrate access policy across cloud platforms and the wider stack, addressing the fragmentation that makes multi-cloud governance hard to see and harder to enforce, according to Strata Identity. The architectural shift matters because policy consistency, not another enforcement silo, is what identity teams need to regain control.
Editorial analysis by NHI Mgmt Group, based on content published by Strata Identity: “What is IDQL? A guide to Hexa Policy Orchestration”.
Key questions
Q: What breaks when access policies stay static in a dynamic cloud environment?
A: Static roles and permissions quickly drift away from actual business and technical conditions.
Q: Why does fragmented metadata and policy enforcement increase risk in multi-cloud data environments?
A: Fragmented governance makes it harder to know what data exists, who can use it, and whether protection rules are being applied consistently.
Q: How do teams know whether policy orchestration is actually helping?
A: It is helping when the organisation can show fewer manual policy translations, fewer cloud-specific exceptions, and clearer lineage from written policy to deployed enforcement.
Practitioner guidance
- Define a portable policy model Document the access rules that must survive translation across clouds, applications, and network controls before introducing orchestration.
- Inventory policy sources and drift Map where policy is authored today, where it is enforced, and where equivalent rules diverge across platforms and business units.
- Test translation fidelity before scale-out Pilot a small set of high-value rules and verify that the translated policy preserves intent in each target system.
Bottom line: Multi-cloud policy fragmentation is a governance problem because access rules are authored, translated, and enforced differently across systems.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
25/06/2026 9:51 am
Policy fragmentation has become the hidden control plane problem in multi-cloud IAM. Enterprises do not mainly lack more enforcement points. They lack a durable way to express one policy intent across platforms that each insist on their own syntax, scope, and runtime model. That creates governance gaps in visibility, review, and change control, especially when identity, application, data, and network policies diverge. The practitioner conclusion is that policy portability has become a core identity control requirement, not an architecture preference.
A few things that frame the scale:
- Only 44% of developers are reported to follow security best practices for secrets management, exposing a significant developer behaviour gap, according to the State of Secrets in AppSec.
A question worth separating out:
Q: What is the difference between policy orchestration and runtime enforcement?
A: Policy orchestration coordinates how policy is discovered, translated, and distributed across systems. Runtime enforcement is the target platform’s actual decision-making at the moment access is requested. Orchestration improves consistency, but it does not replace the local authorisation engine that makes the final access decision.
👉 Read our full editorial: IDQL and Hexa aim to unify policy across fragmented cloud estates