Topic starter
12/06/2026 9:20 pm
TL;DR: IAM tools in 2026 still concentrate on authentication, directories, and reporting, while time-bound access is emerging as a core evaluation criterion for zero-trust and high-compliance environments, according to Cerbos. The practical issue is no longer whether an IAM stack can log activity, but whether it can support ephemeral entitlements and policy enforcement without standing privilege.
Editorial analysis by NHI Mgmt Group, based on content published by Cerbos: “Top 9 Identity & Access Management (IAM) Tools for 2026”.
Key questions
Q: What breaks when IAM tools do not share a single identity graph?
A: What breaks is the ability to compute effective permissions across delegation chains and systems in real time.
Q: Why do standing privileges undermine Zero Trust programmes?
A: Standing privileges undermine Zero Trust because they allow access to exist before it is needed and continue after the work is complete.
Q: What are the signs that an IAM programme is not enforcing access at runtime?
A: Common signs include policy changes that take too long to appear in downstream apps, access approvals that do not expire automatically, and audit logs that show activity without proving the decision was bounded.
Practitioner guidance
- Map where authorization is enforced Inventory which layer actually decides access today, whether that is the IAM tool, the application, or a separate policy engine.
- Convert standing access to expiry-based access Prioritise access paths that currently persist indefinitely, then redesign them so the entitlement expires automatically after a task or session ends.
- Test policy changes across the full access chain Validate whether a rule change in the identity layer is reflected consistently in downstream applications, APIs, and reporting.
Bottom line: IAM tools still centre on identity administration, but the real governance issue is whether access is enforced where decisions happen.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 7 days ago by NHI Mgmt Group
12/06/2026 11:21 pm
Identity tooling is still too often organised around administration, not enforcement. The article shows that authentication, directory services, and logging remain the default IAM centre of gravity, while access policy is treated as a separate concern. That division produces a governance gap because the system that knows who the subject is is not always the system deciding what the subject can do. Practitioners should read this as a sign that identity administration and authorization governance are still too loosely coupled.
A few things that frame the scale:
- Only 44% of developers are reported to follow security best practices for secrets management, exposing a significant developer behaviour gap, according to the State of Secrets in AppSec.
A question worth separating out:
Q: How should teams decide whether to use IAM, IGA, or both?
A: Use IAM for identity execution tasks such as authentication, provisioning, and access control. Use IGA when you need governance, certification, policy enforcement, and auditability. Most mature programmes need both because secure access is not the same as justified access. If the organisation cannot answer why access exists, IAM alone is not enough.
👉 Read our full editorial: IAM tools in 2026 still leave access decisions split
This post was modified 7 days ago by NHI Mgmt Group