Topic starter
10/06/2026 11:17 pm
TL;DR: Access control audits increasingly fail at the authorization layer, where enterprises can document roles and policies but still cannot prove who could do what, when, and why, according to Cerbos and the 2025 OWASP and Verizon findings cited in the article. The real governance gap is evidence of enforcement, not policy intent, and that gap spans human users, non-human identities, and AI agents.
Editorial analysis by NHI Mgmt Group, based on content published by Cerbos: “5 authorization blind spots auditors find, and how to fix them”.
By the numbers:
- Broken access control held the number-one spot on the OWASP Top 10 for two consecutive releases.
- The Verizon 2025 DBIR found that 22% of breaches began with stolen or compromised credentials.
- The Verizon 2025 DBIR also found that 88% of basic web application attacks involved stolen or compromised credentials.
Key questions
Q: What breaks when access control audits can show policy but not enforcement evidence?
A: Audit assurance breaks because teams can no longer demonstrate what was actually permitted at decision time.
Q: Why does poor authorization create more breach risk even when authentication is strong?
A: Authentication only proves identity at login.
Q: Why do service accounts and AI agents need different controls from human users?
A: Service accounts and AI agents authenticate and act without the predictable patterns that human identity systems expect.
Practitioner guidance
- Inventory authorization decision points Map where access decisions are made across applications, gateways, APIs, and data services, then separate auditable enforcement points from code paths that cannot produce evidence.
- Capture decision-level audit logs Record the subject, resource, action, policy version, and allow-or-deny outcome for every sensitive authorization event so audits are based on proof, not reconstruction.
- Rework access reviews around permissions Use resource-level entitlements and actual allowed actions in certification workflows instead of approving abstract role names that hide privilege drift.
Bottom line: The core audit problem is not whether policies exist, but whether teams can prove how access was enforced in context.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 5 days ago by NHI Mgmt Group
12/06/2026 5:11 am
Authorization evidence, not policy intent, is now the audit battleground: Many enterprises can document roles, group assignments, and access policies, yet still cannot prove the runtime decision that allowed or denied a request. That is a governance failure because auditors increasingly want evidence of enforcement at the moment of access, not a description of what the policy was supposed to do. Practitioners should treat this as a control-evidence gap, not a reporting gap.
A few things that frame the scale:
- 96% of security operations teams report critical blind spots, most commonly in cloud infrastructure (74%) and identity and access behaviour (67%).
A question worth separating out:
Q: How should security teams govern authorization across multiple applications?
A: Security teams should move access decisions into a centrally managed policy layer, then assign ownership for policy design, testing, and exception handling. That gives IAM a consistent control point for change management, audit evidence, and cross-application enforcement instead of relying on duplicated code paths in every service.
👉 Read our full editorial: Access control audits fail where authorization evidence is missing
This post was modified 5 days ago by NHI Mgmt Group