Topic starter
21/08/2026 4:43 pm
TL;DR: MTX Group and Oleria are positioning continuous, adaptive governance as the answer to access sprawl across employees, service accounts, machine identities, and AI agents in regulated environments, according to Oleria Security. The real issue is not visibility alone but whether identity governance can keep pace with changing access across human, non-human, and autonomous systems.
Editorial analysis by NHI Mgmt Group, based on content published by Oleria Security: “MTX Group and Oleria partner to modernize identity governance across public sector and regulated industries”.
Key questions
Q: How should security teams govern access across human, NHI, and AI identities?
A: Security teams should govern all three through a shared lifecycle and policy layer, but with different operating rules for each actor type.
Q: Why does standing privilege still create so much identity risk?
A: Standing privilege keeps elevated access available long after the work that justified it has ended.
Q: What breaks when access reviews are only run on a fixed schedule?
A: Fixed-cycle reviews encourage repetition, not judgment.
Practitioner guidance
- Map all identity classes to one governance model Bring employees, contractors, service accounts, machine identities, and AI agents into a single access governance inventory so review and revocation rules are consistent across identity types.
- Eliminate persistent access where the business case is weak Identify standing privilege in human and non-human accounts, then remove it where tasks can be completed with time-bound or context-bound access instead.
- Tie lifecycle controls to identity state changes Trigger certification, revocation, and reassignment actions from creation, role change, service change, and decommission events instead of relying on periodic campaigns.
Bottom line: The central problem is not access volume alone, but the mismatch between fast-changing identity estates and governance models built for slower review cycles.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
21/08/2026 5:04 pm
Continuous governance is becoming the default control model for mixed identity estates. Periodic access reviews were designed for slower-moving environments where entitlements could be certified after the fact. That assumption fails when human, NHI, and AI access changes continuously across cloud and digital transformation programmes. The implication is that governance itself is shifting from a calendar activity to a runtime control discipline.
A few things that frame the scale:
- Nearly 60% of IT leaders cite restrictive cost and complexity as a weakness of legacy identity governance, according to the 2025 State of Identity Governance Report.
A question worth separating out:
Q: What should regulated organisations do to keep governance aligned with cloud and AI adoption?
A: They should bind governance to lifecycle events, usage context, and privilege changes so compliance evidence is generated as access changes. That makes it possible to modernise without losing control over human and non-human identities that now move through the environment at different speeds.
👉 Read our full editorial: MTX and Oleria partnership raises the bar for identity governance