Topic starter
11/08/2026 3:13 pm
TL;DR: Opal Security reports that across half a million access requests, median approval time reached 15 minutes, some latencies exceeded 24 hours, 43.5% of granted access went unused for more than 90 days, and agent and non-human identities grew 2,300%, exposing how manual review no longer scales. Review-based IAM assumes access can be assessed slowly and still remain meaningful, but that assumption collapses when access volume and identity sprawl outrun human judgment.
Editorial analysis by NHI Mgmt Group, based on content published by Opal Security: “Paladin: AI that applies your policy to every request”.
Key questions
Q: What breaks when access reviews are still mostly manual?
A: Manual reviews fail when identities change state, permissions spread across multiple systems, or access is granted too quickly for periodic certification to catch it.
Q: Why do non-human identities complicate IAM governance?
A: Non-human identities complicate IAM governance because they do not behave like people.
Q: How should security teams prove authorization controls are operating effectively?
A: Security teams should require evidence that access controls were active, monitored, and reviewed over time, not just documented once.
Practitioner guidance
- Separate routine from exceptional access decisions Define which requests can be policy-scored or auto-approved and which must be routed to a human reviewer with explicit escalation criteria.
- Build different governance paths for NHIs and humans Classify service accounts, agents, and human users separately so review logic can reflect different ownership, lifespan, and entitlement patterns.
- Attach decision context to every approval Require access rationale, identity context, and policy basis to travel with the decision record so auditors can reconstruct why it was granted.
Bottom line: Manual access review becomes unreliable when request volume and identity sprawl outrun the time humans have to evaluate each case.
What's in the full announcement
Opal Security's full article covers the operational detail this post intentionally leaves for the source:
- The access-review workflow design behind Paladin's decisioning model and how it reasons over policy.
- The specific connected systems used to gather context for access decisions, including tickets, docs, incidents, and approvals.
- The role boundaries for when AI can recommend, decline, or escalate an access request.
- The role-mining and policy-suggestion use cases that extend the approach beyond approvals.
👉 Read Opal Security's analysis of how AI review exposes the limits of manual IAM →
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 5 days ago by NHI Mgmt Group
11/08/2026 3:27 pm
Manual approval workflows were designed for bounded request volumes, not for identity estates that generate decisions continuously. Once access requests become a high-throughput stream, the reviewer is no longer judging meaningful exceptions. They are triaging backlog, which turns review into a latency problem instead of a governance control. The practical consequence is that least privilege becomes harder to maintain because the decision system is slower than the identity system it is supposed to govern.
A question worth separating out:
Q: What should organisations do before they automate access decisions?
A: They should make sure the underlying identity data is accurate, complete, and owned. Automation only improves governance when the access catalog, role model, and entitlement records are already trustworthy; otherwise it accelerates bad decisions instead of fixing them.
👉 Read our full editorial: AI review for access requests exposes the limits of manual IAM
This post was modified 5 days ago by NHI Mgmt Group