Topic starter
25/06/2026 10:25 pm
TL;DR: Access management and runtime controls are the focus of a live briefing on current identity and security priorities, giving practitioners a chance to hear how the vendor frames these issues and what questions that raises for governance, operations, and access policy design, according to ASPG.
Editorial analysis by NHI Mgmt Group, based on content published by ASPG: “Guest Webinar with Greg Boyd”.
Key questions
Q: How should security teams implement runtime access decisions in identity governance?
A: Start with the highest-risk decisions, such as privileged access and sensitive application requests, and wire in live signals from security and device telemetry.
Q: What is the difference between access approval and runtime enforcement?
A: Access approval decides whether an identity may be granted access, while runtime enforcement decides what that identity can actually do once the session is active.
Practitioner guidance
- Map the runtime enforcement points Identify where access is enforced during an active session, workflow, or transaction rather than only at login or approval.
- Separate approval from control Document which permissions are granted by policy and which are narrowed by runtime conditions such as context, step-up checks, or transaction rules.
- Test active-session privilege drift Review whether an identity can do more once a session is established than the original entitlement review would suggest.
Bottom line: The listing points to a governance discussion about identity access management and runtime controls rather than a product announcement or technical release.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
25/06/2026 10:56 pm
Runtime control is where identity programmes prove whether policy is real. Access management only matters if the system can still shape behaviour after the initial grant. When governance stops at approval, the programme has created a paper boundary, not an operational one. Practitioners should treat runtime enforcement as the test of whether identity policy survives contact with production.
A question worth separating out:
Q: Why do human and non-human identities need different runtime controls?
A: Because the compromise paths differ even when the impact looks similar. Human identities are more often exposed through sessions and social engineering, while non-human identities are more often exposed through dependency abuse, stale credentials, or overprivilege. Runtime controls must reflect those differences.
👉 Read our full editorial: Guest webinar on identity access management and runtime controls