Topic starter
14/09/2026 10:09 am
TL;DR: Periodic certification leaves standing privilege and access drift unchecked across human, non-human, and AI identities, according to Oleria Security. Identity governance now has to track effective access continuously, or review cycles will keep missing privilege that persists after the original need has passed.
Editorial analysis by NHI Mgmt Group, based on content published by Oleria Security: “SDG and Oleria Announce Strategic Partnership to Modernize Identity Governance for the AI Era”.
Key questions
Q: How should IAM teams govern human, non-human, and AI identities together?
A: Start by separating the identity types in policy, ownership, and review cadence, then define where controls can be shared and where they must remain distinct.
Q: What are the signs that standing privilege is becoming a governance problem?
A: The main signs are permissions that outlive the original task, identities with unclear ownership, and review outcomes that rarely lead to removals even as access expands.
Q: What breaks when identity governance still depends on periodic certification?
A: Periodic certification breaks when identities change faster than the review cycle can capture.
Practitioner guidance
- Map every identity class into one governance model Build a single inventory that covers employees, contractors, service accounts, applications, machine identities and AI agents, then link each to its effective access and owner.
- Replace review-only governance with continuous entitlement monitoring Trigger governance checks when access changes, not only when review periods open, so standing privilege and access drift are visible while they still matter.
- Define lifecycle ownership for non-human and AI identities Assign explicit owners for provisioning, approval, rotation, revocation and offboarding so governance does not stop at human account processes.
Bottom line: Periodic certification is no longer sufficient for estates that include human, non-human and AI identities, because access can drift faster than review cycles can close.
Glossary terms: Continuous Identity Governance, Standing Privilege, Effective Access, Identity Drift
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 6 days ago by NHI Mgmt Group
14/09/2026 10:10 am
Continuous governance is now the baseline control for mixed identity estates. Periodic certification was designed for environments where access changed slowly enough to be sampled and approved in batches. That model fails when employees, contractors, service accounts, machine identities and AI agents all mutate access state on different timelines. The implication is that identity governance is becoming a live operational control, not a calendar exercise.
A few things that frame the scale:
- Nearly 60% of IT leaders cite restrictive cost and complexity as a weakness of legacy identity governance, according to the 2025 State of Identity Governance Report.
A question worth separating out:
Q: How should organisations govern AI agents alongside human identity and device access?
A: Organisations should treat AI agents as a separate identity class with their own entitlement boundaries, logging expectations, and approval model. Human IAM controls often assume interactive sign-in and review cycles, which do not fit autonomous or programmatic access. The safer approach is to define actor-specific policy and verify which access paths can be delegated without expanding trust unnecessarily.
👉 Read our full editorial: AI era identity governance needs continuous visibility across every actor