Topic starter
12/06/2026 9:58 pm
TL;DR: The core issue is not automation itself, but whether identity governance can keep pace with discovery, review, and cleanup across human, NHI, and delegated access patterns, according to Josys’ April 2026 release, which adds automated app classification, targeted access reviews, Google Workspace user filtering, API-driven attribute sync, and workflow retry controls to reduce manual governance overhead for SaaS-heavy environments.
Editorial analysis by NHI Mgmt Group, based on content published by Josys: “Product Release Newsletter: April 2026”.
By the numbers:
- When adoption grows to 20+ users, Josys can notify teams, evaluate conditions, auto-approve trusted apps, and auto-block unapproved ones.
Key questions
Q: How should teams handle access reviews in fast-changing SaaS environments?
A: Teams should move from periodic, app-by-app certification to centralized review of the full entitlement graph.
Q: Why do unapproved apps create more governance risk than teams expect?
A: Unapproved apps matter because they create an access path outside the normal approval and review process, so policy cannot be enforced at the same speed as adoption.
Q: What breaks when identity attribute sync is all-or-nothing?
A: All-or-nothing sync breaks governance because it can overwrite locally managed fields, erase context, and make downstream access decisions less reliable.
Practitioner guidance
- Define governance triggers for newly discovered apps Create explicit conditions for when a new app moves from discovery to approval review, warning, or block so shadow IT is handled consistently.
- Scope access reviews by business relevance Use role, department, and risk filters to limit reviews to the accounts that actually require certification, then pair them with reminder and closure rules.
- Separate managed and local identity attributes Classify each user field as source-controlled or Josys-managed before enabling sync so external directories do not overwrite locally governed values.
Bottom line: The central governance issue is not whether SaaS automation exists, but whether discovery, certification, and cleanup are coordinated tightly enough to keep pace with change.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
13/06/2026 12:25 am
Access governance now fails more often at the coordination layer than at the policy layer. Most teams already have review processes, approval states, and app inventories. The problem is that those controls are not synchronized tightly enough with discovery and sync events to keep pace with SaaS churn. Practitioners should read this as a governance operations problem, not a feature checklist problem.
A few things that frame the scale:
- 92% of organisations expose NHIs to third parties, raising concerns about supply chain security, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: How should teams handle failed workflow automation in identity governance?
A: Teams should treat failed workflow runs as governance exceptions, not as hidden technical noise. If a workflow cannot be retried cleanly, the failure should be triaged against the underlying integration issue and the access or app state it was supposed to change. Otherwise manual fixes become the control.
👉 Read our full editorial: Josys April release tightens access governance and app control