Topic starter
22/10/2026 1:58 pm
TL;DR: Oak argues that most organisations should augment legacy IGA first because coverage gaps, not workflow design, are usually the real problem, and replacement only makes sense when the platform is unsupported or structurally cannot model what must be governed. The decisive measurements are coverage gap, effective access, blast radius, and decision latency.
Editorial analysis by NHI Mgmt Group, based on content published by Oak: “Replace Your IGA or Build on It? How to Decide”.
Key questions
Q: What should teams do first when legacy IGA coverage is incomplete?
A: Start by measuring the gap between the estate and what the IGA actually connects to.
Q: Why does effective access matter more than assigned entitlements in IGA decisions?
A: Because assigned entitlements describe intent, while effective access describes what an identity can really do once nested groups, delegation, and inherited rights resolve.
Q: Why do service accounts and AI agents need different controls from human users?
A: Service accounts and AI agents authenticate and act without the predictable patterns that human identity systems expect.
Practitioner guidance
- Map the coverage gap first List every system in the estate and compare it with every system the IGA actually connects to.
- Measure effective access against real reach Sample identities and compare declared entitlements with what they can reach after nested groups, inherited rights, and impersonation chains resolve.
- Score blast radius on high-privilege identities Start with service accounts and AI agents, then weight the access path by resource sensitivity and by how many other identities or systems they can touch.
Bottom line: The article’s core argument is that many IGA disputes are really coverage disputes, where the platform governs only the identities and systems it can already see.
What's in the full article
Oak's full post covers the operational detail this analysis intentionally leaves for the source:
- Side-by-side comparison of replacement versus augmentation across coverage, review model, remediation, and program risk
- Detailed measurement method for effective access and blast radius across nested groups and impersonation chains
- Operational discussion of ConnectAny connectors, including direct API, database, file upload, and on-prem agent paths
- White Glove migration handling for mapping the environment and reading policies and roles out of the incumbent
👉 Read Oak's analysis of when to replace legacy IGA or build on it →
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 23 minutes ago by NHI Mgmt Group
22/10/2026 1:58 pm
Coverage, not workflow, is the governing failure mode: When an IGA only governs connected systems, the organisation does not have an identity governance problem in the abstract, it has a visibility boundary problem. That boundary is what service accounts, bots, and AI agents exploit by existing outside the review model. The implication is that replacement should not be the default response to every governance complaint; the first question is whether the estate was ever fully in scope.
A few things that frame the scale:
- Nearly 60% of IT leaders cite restrictive cost and complexity as a weakness of legacy identity governance, according to the 2025 State of Identity Governance Report.
A question worth separating out:
Q: When should organisations replace an IGA instead of building on it?
A: Replace only when the platform is unsupported, cannot represent the data you need, or costs more to keep alive than it returns. If the issue is that access exists outside the model, augmentation is usually the more direct fix because it extends governance without waiting for a cutover.
👉 Read our full editorial: Replacing legacy IGA or augmenting it depends on coverage gaps
This post was modified 23 minutes ago by NHI Mgmt Group