Topic starter
14/09/2026 10:09 am
TL;DR: Continuous governance is becoming the baseline for human, non-human, and AI identities because periodic certification leaves standing privilege and access drift unchecked, according to Oleria Security’s partnership announcement with SDG. The governance model now has to treat identity as a live control surface, not a quarterly review exercise.
Editorial analysis by NHI Mgmt Group, based on content published by Oleria Security: “SDG and Oleria Announce Strategic Partnership to Modernize Identity Governance for the AI Era”.
Key questions
Q: What breaks when identity governance still depends on periodic certification?
A: Periodic certification breaks when identities change faster than the review cycle can capture.
Q: How should IAM teams govern human, non-human, and AI identities together?
A: Start by separating the identity types in policy, ownership, and review cadence, then define where controls can be shared and where they must remain distinct.
Q: What are the signs that standing privilege is becoming a governance problem?
A: The main signs are permissions that outlive the original task, identities with unclear ownership, and review outcomes that rarely lead to removals even as access expands.
Practitioner guidance
- Map every identity class into one governance model Build a single inventory that covers employees, contractors, service accounts, applications, machine identities and AI agents, then link each to its effective access and owner.
- Replace review-only governance with continuous entitlement monitoring Trigger governance checks when access changes, not only when review periods open, so standing privilege and access drift are visible while they still matter.
- Define lifecycle ownership for non-human and AI identities Assign explicit owners for provisioning, approval, rotation, revocation and offboarding so governance does not stop at human account processes.
Bottom line: Periodic certification is no longer sufficient for estates that include human, non-human and AI identities, because access can drift faster than review cycles can close.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
14/09/2026 10:10 am
Continuous governance is now the baseline control for mixed identity estates. Periodic certification was designed for environments where access changed slowly enough to be sampled and approved in batches. That model fails when employees, contractors, service accounts, machine identities and AI agents all mutate access state on different timelines. The implication is that identity governance is becoming a live operational control, not a calendar exercise.
A few things that frame the scale:
- Nearly 60% of IT leaders cite restrictive cost and complexity as a weakness of legacy identity governance, according to the 2025 State of Identity Governance Report.
A question worth separating out:
Q: How should organisations govern AI agents alongside human identity and device access?
A: Organisations should treat AI agents as a separate identity class with their own entitlement boundaries, logging expectations, and approval model. Human IAM controls often assume interactive sign-in and review cycles, which do not fit autonomous or programmatic access. The safer approach is to define actor-specific policy and verify which access paths can be delegated without expanding trust unnecessarily.
👉 Read our full editorial: AI era identity governance needs continuous visibility across every actor