Topic starter
11/06/2026 11:37 pm
TL;DR: Full IGA platforms automate approvals, certifications, and policy enforcement, but they still depend on complete connectivity, clean data, and consistent adoption, leaving legacy systems, ad hoc exceptions, orphaned accounts, and identity drift outside the governance model according to Gathid. The governance problem is not whether IGA exists, but whether it can prove daily access reality across the full environment.
Editorial analysis by NHI Mgmt Group, based on content published by Gathid: “Full IGA Is Never Really Full IGA. You Still Need Gathid”.
Key questions
Q: What breaks when full IGA coverage is incomplete?
A: Governance breaks at the boundary between the platform and the real estate it cannot see.
Q: Why does incomplete identity context create governance risk?
A: Because access decisions need current business meaning, not just technical entitlement records.
Q: What are the signs that an IGA programme is drifting from reality?
A: Look for stale role models, recurring exceptions, orphaned accounts, unresolved blind spots in unconnected systems, and review outcomes that do not match live access patterns.
Practitioner guidance
- Map governed and ungoverned identity surfaces Inventory which systems feed the IGA platform and which still sit outside it, including legacy applications, OT, physical access, contractors, and third parties.
- Validate certifications against live access data Compare review outcomes with current entitlements, employment status, and business ownership so certifications reflect the real access state rather than the last approval record.
- Use contextual identity to improve role decisions Attach job function, department, and employment status to governance decisions so access models and separation-of-duties rules reflect current business context.
Bottom line: Full IGA deployment does not eliminate governance gaps when systems, exceptions, and access paths remain outside the tool’s visibility.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 1 day ago by NHI Mgmt Group
12/06/2026 8:22 am
Full IGA is a control framework, not proof of complete governance. The vendor article correctly shows that approvals, certifications, and policies can exist while identity risk remains outside the governed boundary. That is because connector coverage, data quality, and business adoption determine what the platform can actually see. Practitioners should stop equating deployment with assurance and instead measure what portion of the identity estate is still invisible.
A few things that frame the scale:
- Nearly 60% of IT leaders cite restrictive cost and complexity as a weakness of legacy identity governance, according to the 2025 State of Identity Governance Report.
A question worth separating out:
Q: How should teams govern systems that sit outside the IGA tool?
A: They should assign an explicit ownership and evidence path instead of assuming the platform will eventually absorb them. If a system cannot be connected yet, its access must still be reviewed, mapped, and risk-ranked separately so it does not become a permanent blind spot.
👉 Read our full editorial: Daily trust exposes the blind spots in full IGA coverage
This post was modified 1 day ago by NHI Mgmt Group