Topic starter
22/06/2026 10:10 am
TL;DR: Opal Security says non-human and agent identities already outnumber people, and the roughly 100-hour access review cycle cannot keep pace, so manual governance is breaking at machine scale. Human accountability still matters, but review processes now need machine-speed execution and auditable decisions.
Editorial analysis by NHI Mgmt Group, based on content published by Opal Security: “Access Has Outgrown Human Scale. We're Building the Governance to Match.”.
Key questions
Q: What breaks when access reviews are only run on a fixed schedule?
A: Fixed-cycle reviews encourage repetition, not judgment.
Q: Why do AI-guided access reviews still need a human sign-off?
A: Because recommendation quality and accountability are different controls.
Q: How do teams know if automated access reviews are actually working?
A: Automated reviews are working when exception rates fall, reviewer overrides become rare, and access decisions are grounded in clean role definitions rather than ad hoc exceptions.
Practitioner guidance
- Map access review latency against identity churn Measure how long certification cycles take relative to how quickly entitlements are created, modified, and removed across human, service, and agent identities.
- Group low-risk access before reviewers see it Use risk-based clustering so reviewers can clear obvious grants quickly and focus on access that changes blast radius or ownership.
- Preserve a complete audit trail for every recommendation Record the access graph snapshot, grouping logic, reviewer decision, and timestamp so each certification remains defensible after the campaign closes.
Bottom line: Human-scale access reviews are no longer a reliable control model when identity churn exceeds reviewer capacity.
What's in the full announcement
Opal Security's full product post covers the operational detail this post intentionally leaves for the source:
- How Paladin groups access grants and surfaces supporting evidence during certification
- The mechanics of query-based scoping and automatic reviewer assignment
- The workflow for progress tracking, reminders, and decision history across campaigns
- How AI-assisted remediation and access requests share the same access graph and audit trail
👉 Read Opal Security's analysis of AI-guided access reviews for machine-scale governance →
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
22/06/2026 10:57 am
Access review cadence was designed for stable human identity estates. That assumption weakens when non-human and agent identities dominate the access graph and change faster than a campaign window can absorb. The implication is not merely more automation. It is that certification itself must be rethought as a machine-paced governance process with human accountability preserved at the final decision point.
A few things that frame the scale:
- Over 70% of organisations lack automated access risk analysis, user access reviews and provisioning and deprovisioning, according to Pathlock's 2025 Digital Transformation and Access Risk Report.
A question worth separating out:
Q: How should IAM teams govern human, non-human, and AI identities together?
A: Start by separating the identity types in policy, ownership, and review cadence, then define where controls can be shared and where they must remain distinct. Human users, service identities, and AI systems do not fail in the same way, so the governance model has to preserve that difference while still producing one audit trail.
👉 Read our full editorial: AI-guided access reviews expose the limits of human-scale IAM