Topic starter
12/07/2026 12:18 pm
TL;DR: Identity stacks manage policy and intent well, but they still miss the authority pathways created by inheritance, delegated access, and cross-system relationships, according to Gathid. The structural gap is now the real identity risk, because review tools cannot see what authority has accumulated across the environment.
Editorial analysis by NHI Mgmt Group, based on content published by Gathid: “The Missing Layer In Identity And Access Management”.
Key questions
Q: What breaks when IAM tools only review policy intent?
A: They miss the authority that emerges from inheritance, delegation and role combinations across systems.
Q: Why does identity create more risk when privilege is inherited across systems?
A: Inherited privilege hides where authority really comes from and makes blast radius difficult to see.
Q: How can teams detect hidden authority pathways before they become incidents?
A: By modelling identities, groups, roles, credentials and system relationships together, then recomputing that model regularly against authoritative enterprise state.
Practitioner guidance
- Map authority pathways across systems Build a relationship graph that connects identities, groups, roles, credentials and cross-account trusts so reviewers can see how authority is actually formed.
- Rework access reviews around effective control Add analysis for inherited permissions, nested groups and role combinations so reviews expose accumulated authority rather than only approved entitlements.
- Inventory dormant automation and service accounts Find non-human identities that still hold production access after the original project or owner relationship ended, then validate whether the authority chain is still justified.
Bottom line: Modern IAM stacks can validate policy intent while still missing the authority that emerges across inherited and delegated relationships.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
12/07/2026 12:31 pm
Authority pathways are the real blind spot in modern IAM. The article’s central point is that policy-centric controls do not reveal how effective authority emerges once identities, roles and systems start inheriting from one another. That means the governance problem is structural, not procedural. Practitioners should treat authority mapping as a distinct control layer, not as a feature of existing IAM tooling.
A few things that frame the scale:
- 97% of NHIs carry excessive privileges, increasing unauthorised access and broadening the attack surface, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: Should organisations apply the same access review process to human and non-human identities?
A: No. Human access reviews can work on periodic certification cycles, but non-human identities often change faster and need event-based review tied to deployment, rotation, or decommissioning. The better model is shared governance with different review mechanics, so the process matches how each identity class is created, used, and retired.
👉 Read our full editorial: Authority pathways are exposing the limits of modern IAM stacks