Topic starter
24/06/2026 11:29 pm
TL;DR: Clarity Security's analysis of 2025 identity governance changes finds ABAC shifted access decisions from static roles to context-aware policy, alongside 74,667 joiners onboarded and 113,628 movers automated. Governance now has to keep automated access explainable, auditable, and visible across human and non-human identities.
Editorial analysis by NHI Mgmt Group, based on content published by Clarity Security: “2025 Year in Review: How Our Customers Reclaimed 438k Manual Work Hours”.
By the numbers:
- Clarity Security says 674 UARs were completed across its customer base in 2025.
Key questions
Q: Why does role bloat become a problem in identity governance programmes?
A: Role bloat happens when static roles try to represent too many exceptions, business contexts, and lifecycle variations.
Q: What breaks when joiner-mover-leaver workflows are mostly manual?
A: Manual workflows create delay, inconsistency, and missed revocations.
Q: How should teams implement ABAC without losing governance control?
A: Implement ABAC in narrow use cases first, where the attributes driving the decision are well understood and easy to audit.
Practitioner guidance
- Define where ABAC can replace RBAC Start with access paths where role bloat, frequent exceptions, or multi-role users make static roles inefficient.
- Inventory the attributes your policies depend on Identify which sources provide role, device, location, entitlement, and lifecycle signals, then check whether those values are current and consistent across systems.
- Map dependent entitlements before automating workflows Document which downstream applications, groups, and cloud identities must change when a joiner, mover, or leaver event occurs.
Bottom line: ABAC changes identity governance by moving access decisions from static roles to context-aware policy, which reduces role bloat but raises the bar for attribute quality.
Glossary terms: Attribute-Based Access Control, Joiner, Mover, Leaver Workflow, Role Bloat, Interaction-Level Audit Trail
What's in the full article
Clarity Security's full article covers the operational detail this post intentionally leaves for the source:
- Step-by-step detail on the ABAC engine and how policy decisions are evaluated in practice
- Expanded explanations of the one-click integrations and custom webhook flows
- More detail on the privileged access tagging, nested access reports, and Azure Managed Identity visibility
- The full 2025 usage totals and productivity calculations behind the hours-saved figure
👉 Read Clarity Security's analysis of ABAC and autonomous identity governance in 2025 →
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 6 days ago by NHI Mgmt Group
25/06/2026 8:23 am
ABAC is a governance model shift, not just a feature upgrade. Role-based access control was built for stability, while modern identity environments are defined by context changes, nested entitlements, and frequent lifecycle movement. Once those conditions dominate, the control problem moves from role maintenance to policy quality and attribute trust. Practitioners should treat ABAC as a governance operating model with audit consequences, not as a shortcut around IGA discipline.
A few things that frame the scale:
- Nearly 60% of IT leaders cite restrictive cost and complexity as a weakness of legacy identity governance, according to the 2025 State of Identity Governance Report.
A question worth separating out:
Q: How do security teams keep privileged access visible in automated governance?
A: Keep privileged access discovery and non-human identity inventory as explicit controls, not side effects of provisioning. Dynamic policy can hide risk if the team cannot still identify Tier 0 and Tier 1 access, nested groups, and machine identities before decisions are made.
👉 Read our full editorial: ABAC and autonomous identity governance: what 2025 changed