Topic starter
12/06/2026 9:46 pm
TL;DR: Identity-centric Zero Trust still breaks down when governance decisions are not enforced at session start, and the Saviynt-Zscaler partnership is aimed at closing that gap by combining just-in-time access, inline policy enforcement, and privileged lifecycle visibility, according to Saviynt. The real issue is not whether access is approved, but whether ephemeral privileges can be made to expire as designed before standing privilege becomes the default.
Editorial analysis by NHI Mgmt Group, based on content published by Saviynt: “Press Releases”.
Key questions
Q: What breaks when zero trust governance is not enforced at session start?
A: The control that breaks is the link between approved entitlement and usable access.
Q: Why do time-bound privileges still leave risk if revocation is not inline?
A: Because the risk is not only how long access is approved for, but whether the session layer actually honors that expiry.
Q: How should security teams govern third-party identity access?
A: Security teams should inventory every external identity path, assign an internal owner, and apply scope, expiry, and revocation rules to each connection.
Practitioner guidance
- Tie approval to session start Ensure privileged access decisions are enforced inline when the session begins, so the approved scope is the only scope that can be exercised.
- Replace standing privilege with time-bound access Use just-in-time access for privileged tasks that do not require persistent credentials, and make revocation automatic at the end of use.
- Separate third-party lifecycle handling Create dedicated onboarding, delegation and expiration rules for partners and vendors instead of reusing employee access workflows.
Bottom line: Identity-centric zero trust weakens when governance decisions are not enforced at the point of session creation.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 5 days ago by NHI Mgmt Group
This topic was modified 3 days ago 2 times by NHI Mgmt Group
13/06/2026 12:04 am
Identity-centric zero trust fails when approval and enforcement are split. The article describes a common control-plane failure: identity decisions are made in one system, while the session is governed elsewhere. That separation lets standing privilege survive even after a request has been formally approved, which weakens the very control zero trust is meant to provide. Practitioners should treat that split as a design defect, not a tuning issue.
A few things that frame the scale:
- 97% of NHIs carry excessive privileges, increasing unauthorised access and broadening the attack surface, according to the Ultimate Guide to NHIs.
- 90% of IT leaders say properly managing NHIs is essential for a successful zero-trust implementation, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: What is the difference between governance approval and inline enforcement?
A: Governance approval decides whether access should exist. Inline enforcement decides whether that access can actually be exercised in the session. Zero trust needs both, because an approved privilege that is not enforced at runtime still creates exposure.
👉 Read our full editorial: Identity-centric zero trust needs inline enforcement, not just governance
This post was modified 5 days ago by NHI Mgmt Group