Topic starter
16/10/2026 9:31 am
TL;DR: Identity governance breaks down when IGA only covers connected systems, leaving on-prem apps, homegrown databases, service accounts and AI agents to be handled by hand and certified from an incomplete picture, according to Oak. Coverage, not workflow, becomes the real control boundary when access reviews and least privilege depend on what the programme can actually see.
Editorial analysis by NHI Mgmt Group, based on content published by Oak: “You Can't Govern What You Can't Connect”.
Key questions
Q: What breaks when identity governance cannot reach legacy and core systems?
A: Access reviews, entitlement discovery, and compliance evidence all become partial.
Q: Why does incomplete coverage create security risk as well as governance drift?
A: Because attackers do not care which systems are integrated, and the unconnected application with a stale admin account is often the easiest path in.
Q: Why do service accounts and AI agents need different controls from human users?
A: Service accounts and AI agents authenticate and act without the predictable patterns that human identity systems expect.
Practitioner guidance
- Map connector coverage against the full identity estate Inventory cloud, SaaS, on-prem, homegrown and file-based sources, then compare that list with what the IGA can currently read.
- Add non-human identities to the governance model Create explicit ownership and lifecycle handling for service accounts, workload identities and AI agents so they are not left to spreadsheet control or ad hoc review.
- Prioritise write-back for remediation Where the platform can identify excess access, make sure it can also push approved changes into the source system rather than exporting remediation to a ticket queue.
Bottom line: Identity governance loses force when the programme can only govern connected systems, because partial coverage turns certification into an incomplete exercise.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
16/10/2026 9:32 am
Coverage is the real control boundary, not the IGA licence line. Identity programmes often behave as though governance starts once the tool is in place, but the article shows the opposite. If a system is not connected, the programme is effectively blind to it, even if policy says it is in scope. That makes coverage a governance primitive, not a deployment milestone. Practitioners should treat connector completeness as a board-relevant control condition, because every unconnected system is a decision domain outside the evidence chain.
A few things that frame the scale:
- Only 5.7% of organisations have full visibility into their service accounts, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: Should organisations prioritise connector coverage before expanding access reviews?
A: Yes. Access reviews only become meaningful when the programme can see the systems, entitlements and usage context that make a certification decision defensible. Expanding review volume before coverage creates more activity, not better governance, because the same blind spots remain in place.
👉 Read our full editorial: Coverage gaps keep identity governance from seeing the full estate