Notifications
Clear all
Topic starter
17/08/2026 4:40 pm
TL;DR: Trusted identity data determines whether access decisions are actually defensible, and Saviynt argues that HR-led governance does not extend cleanly to contractors, vendors, partners, or customers. When authoritative sources are fragmented or absent, identity sprawl, overprovisioning, and compliance gaps follow because the system is certifying records it cannot trust.
NHIMG editorial — based on content published by Saviynt: External Identity Data Management: What Grants You the Authority?
By the numbers:
- Only 5.7% of organisations have full visibility into their service accounts.
- 92% of organisations expose NHIs to third parties, raising concerns about supply chain security.
- 71% of NHIs are not rotated within recommended time frames, increasing the risk of compromise over time.
Questions worth separating out
Q: How should IAM teams govern external identities when no HR system is authoritative?
A: They should assign a formal authoritative source for each external population, such as contractor management, procurement, or a governed identity repository, and make that source the only record that can drive access decisions.
Q: Why do fragmented identity records lead to overprovisioning?
A: Because downstream systems often preserve access when they cannot confidently prove that an identity has changed or ended.
Q: What breaks when contractors and vendors share the same loose identity process?
A: The organisation loses a clean chain of accountability.
Practitioner guidance
- Map authoritative sources by identity population Document which system is authoritative for employees, contractors, vendors, partners, and affiliates, then block provisioning paths that cannot resolve to a current source record.
- Separate intake and offboarding controls for external identities Require a named owner and a revocation path for each non-employee identity type, including service desk, procurement, and business-owner initiated accounts.
- Reconcile entitlement decisions to source attributes Continuously compare assigned access against current authoritative attributes so that role changes, termination dates, and relationship end dates can trigger removal before access lingers.
What's in the full article
Saviynt's full blog post covers the operational detail this post intentionally leaves for the source:
- How its external identity management model centralises identity attributes across contractors, vendors, partners, and affiliates
- The mechanics of data aggregation and normalisation used to reduce duplicate or conflicting records
- Examples of continuous monitoring that flag outdated or incomplete identity records before access drifts
- How organisations can operationalise dynamic access management when authoritative data changes
👉 Read Saviynt's analysis of authoritative identity data for external identity management →
External identity data authority: what IAM teams are missing?
Explore further
View Full Forum → | NHI Foundation Course → | Our Services →
17/08/2026 4:45 pm
Authoritative identity data is the control plane for lifecycle authority: Identity programmes fail when access decisions are made from records that are not the current source of truth. That failure is visible across employees and external identities, but it becomes sharper for contractors, vendors, and partners because their identity events often originate outside HR. The implication is that lifecycle authority must be assigned by population, not assumed from system convenience.
A few things that frame the scale:
- 92% of organisations expose NHIs to third parties, raising concerns about supply chain security, according to the Ultimate Guide to NHIs.
- Only 20% have formal processes for offboarding and revoking API keys, and even fewer have procedures for rotating them.
A question worth separating out:
Q: Who should own lifecycle revocation when identity spans multiple systems?
A: Ownership should sit with the identity governance function, with clear execution responsibilities in IT and application teams. The organisation needs one accountable process for revocation, even if the actual removal steps differ by system. Without that accountability, offboarding becomes inconsistent and hidden access persists longer than it should.
👉 Read our full editorial: Authoritative identity data is the control plane for external access
