Notifications
Clear all
Topic starter
24/06/2026 11:29 pm
TL;DR: A governance shift is clear as role-centric IAM gives way to context-aware, more automated access control that still needs stronger audit and lifecycle discipline, according to Clarity Security. Its 2025 platform changes centered on ABAC, automated lifecycle workflows, and expanded visibility into privileged and non-human access, alongside usage figures showing 74,667 joiners onboarded and 438,255 hours saved.
NHIMG editorial — based on content published by Clarity Security: a 2025 year-end summary of ABAC, automation, and identity governance results
Questions worth separating out
Q: How should teams implement ABAC without creating a new policy sprawl problem?
A: Teams should start with a small set of stable, authoritative attributes and document every policy decision path.
Q: When does lifecycle automation reduce risk versus hide it?
A: Lifecycle automation reduces risk when identity data is current, connectors are reliable, and revocation is verified after each event.
Q: What do identity teams get wrong about nested access?
A: They often review the final permission state without tracing how that permission was inherited.
Practitioner guidance
- Map ABAC policies to explainable attributes Limit production policies to attributes that are authoritative, current, and available at decision time.
- Test lifecycle automation against failure paths Exercise joiner, mover, and leaver workflows with broken connectors, delayed sync, and missing source records.
- Trace entitlement lineage for nested access Require reports that show how a user, group, managed identity, or service account inherited access through each dependency layer.
What's in the full article
Clarity Security's full post covers the operational detail this post intentionally leaves for the source:
- The ABAC engine mechanics behind attribute-based access decisions and how policies are applied across different contexts.
- The specific integration and provisioning updates across Entra ID, ServiceNow, Snowflake, SAP, and other connected systems.
- The customer usage figures behind joiner, mover, leaver, and review automation, including how the hours-saved estimate was calculated.
- The review workflow changes that make attribute-level audit trails and remediation actions easier to execute in the product.
👉 Read Clarity Security's year-end summary on ABAC and identity governance automation →
ABAC and identity governance automation: what changed in 2025?
Explore further
View Full Forum → | NHI Foundation Course → | Our Services →
25/06/2026 8:23 am
ABAC is a policy model, not a governance substitute. Replacing roles with attributes reduces some forms of sprawl, but it does not remove the need for access ownership, recertification, and exception control. If the attributes are wrong or the policy design is opaque, the organisation simply shifts risk into a less visible decision layer. The implication is that ABAC must be governed as a control system, not celebrated as a cleanup exercise.
A few things that frame the scale:
- 91.6% of secrets remain valid five days after the targeted organisation is notified, showing a critical gap in remediation procedures, according to Ultimate Guide to NHIs.
- Only 20% have formal processes for offboarding and revoking API keys, which is why lifecycle control remains a material governance gap for non-human access.
A question worth separating out:
Q: How should organisations govern non-human identities inside IAM reviews?
A: Non-human identities should be reviewed with the same discipline as privileged human access, but with stronger attention to ownership, purpose, and dependency. Reviews should confirm who is accountable, whether the identity is still needed, and whether its inherited access is still justified across systems.
👉 Read our full editorial: ABAC and autonomous identity governance: what 2025 changed
