Topic starter
21/08/2026 4:43 pm
TL;DR: Access governance works better when it follows identity state change instead of fixed review cycles, according to Oleria Security. Identity systems need controls that adjust as access changes across human, NHI, and AI identities.
Editorial analysis by NHI Mgmt Group, based on content published by Oleria Security: “MTX Group and Oleria partner to modernize identity governance across public sector and regulated industries”.
Key questions
Q: Why does standing privilege still create so much identity risk?
A: Standing privilege keeps elevated access available long after the work that justified it has ended.
Q: What breaks when access reviews are only run on a fixed schedule?
A: Fixed-cycle reviews encourage repetition, not judgment.
Q: How should security teams govern access across human, NHI, and AI identities?
A: Security teams should govern all three through a shared lifecycle and policy layer, but with different operating rules for each actor type.
Practitioner guidance
- Map all identity classes to one governance model Bring employees, contractors, service accounts, machine identities, and AI agents into a single access governance inventory so review and revocation rules are consistent across identity types.
- Eliminate persistent access where the business case is weak Identify standing privilege in human and non-human accounts, then remove it where tasks can be completed with time-bound or context-bound access instead.
- Tie lifecycle controls to identity state changes Trigger certification, revocation, and reassignment actions from creation, role change, service change, and decommission events instead of relying on periodic campaigns.
Bottom line: The central problem is not access volume alone, but the mismatch between fast-changing identity estates and governance models built for slower review cycles.
Glossary terms: Continuous Identity Governance, Standing Privilege, Identity state change, Lifecycle Management
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 4 days ago by NHI Mgmt Group
21/08/2026 5:04 pm
Continuous governance is becoming the default control model for mixed identity estates. Periodic access reviews were designed for slower-moving environments where entitlements could be certified after the fact. That assumption fails when human, NHI, and AI access changes continuously across cloud and digital transformation programmes. The implication is that governance itself is shifting from a calendar activity to a runtime control discipline.
A few things that frame the scale:
- Nearly 60% of IT leaders cite restrictive cost and complexity as a weakness of legacy identity governance, according to the 2025 State of Identity Governance Report.
A question worth separating out:
Q: What should regulated organisations do to keep governance aligned with cloud and AI adoption?
A: They should bind governance to lifecycle events, usage context, and privilege changes so compliance evidence is generated as access changes. That makes it possible to modernise without losing control over human and non-human identities that now move through the environment at different speeds.
👉 Read our full editorial: MTX and Oleria partnership raises the bar for identity governance