Topic starter
30/07/2026 10:49 pm
TL;DR: Identity governance platforms often count manual CSV uploads as connected apps, but those flat files are stale, incomplete, and hard to audit, creating false coverage and retained access risk according to Cerby. The governance problem is not connector coverage alone, but whether access data can be verified continuously rather than borrowed from a point-in-time export.
Editorial analysis by NHI Mgmt Group, based on content published by Cerby: “Flat File Governance is a Liability, Not a Bridge”.
Key questions
Q: What breaks when an IGA platform treats flat file uploads as connected apps?
A: The platform loses verification.
Q: Why does stale access create audit and compliance risk for regulated data?
A: Stale access matters because permissions often outlive the project, role, or employee that justified them.
Q: How should teams decide which apps can stay on flat files temporarily?
A: Use flat files only as a short-term exception for low-risk systems with minimal entitlement complexity and no privileged scope.
Practitioner guidance
- Replace flat file coverage with source-system connectors Prioritise direct connectors for applications where access, entitlements, or audit evidence matter, so the governance platform reads the current system state instead of a manually exported copy.
- Reclassify CSV feeds as unverified evidence Stop counting manual uploads as connected apps in dashboards and audit reports, and label them separately so reviewers understand they are point-in-time extracts with limited assurance.
- Target the highest-risk flat file apps first Start with applications that contain privileged access, large entitlement sets, or audit scope, because those are the cases most likely to hide missing accounts and incomplete approval trails.
Bottom line: Flat file governance weakens identity assurance because the platform is certifying copied data, not authoritative source-system state.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
30/07/2026 10:56 pm
Flat file governance creates an identity assurance gap, not just a coverage gap. The problem is not that the platform is missing a connector in the abstract. The problem is that governance is being asserted over data that was copied, scoped, and handled outside the source of truth. That breaks the credibility of access reviews, certifications, and audit reporting because the platform cannot prove what it cannot continuously read.
A question worth separating out:
Q: What is the difference between connected coverage and verified coverage in IGA?
A: Connected coverage means the platform has ingested some access data for the app. Verified coverage means the platform is reading current source-system state in a way that can support review, remediation, and audit without relying on a manually handled export.
👉 Read our full editorial: Flat file governance is breaking identity assurance in IGA