Topic starter
25/06/2026 1:24 am
TL;DR: Identity risk is increasingly an enterprise governance problem shaped by executive blind spots, non-human identities, and agentic AI, with continuous governance and real-time visibility emerging as the operating model, according to Omada Identity. The assumption that access can be reviewed after the fact is breaking as identity decisions move faster than human-paced control cycles.
Editorial analysis by NHI Mgmt Group, based on content published by Omada Identity: “IAM Resources”.
Key questions
Q: What breaks when identity governance relies only on access reviews?
A: Access reviews assume the reviewable state is a stable entitlement that reflects real risk.
Q: Why do non-human identities make identity governance harder to measure?
A: Non-human identities multiply faster than human accounts, often across teams and platforms that do not share a single source of accountability.
Q: How should organisations govern AI-driven access differently from static roles?
A: They should bind access to task, duration, and approved tool scope instead of treating the identity as a permanent role holder.
Practitioner guidance
- Rebuild governance around event-driven decisions Identify where access changes, risk signals, and business events should trigger review automatically instead of waiting for calendar-based recertification.
- Inventory and assign owners for every non-human identity Map service accounts, API keys, tokens, and certificates to named business or platform owners, then define purpose, scope, and offboarding paths.
- Re-test least privilege for agentic workflows Document which approvals, tool permissions, and delegated actions are actually required at runtime when an AI agent can choose its own execution sequence.
Bottom line: Identity governance is moving from periodic compliance checks to continuous control because modern identity decisions now outpace human review cycles.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
25/06/2026 10:48 am
Continuous governance is becoming the baseline because identity risk now changes faster than certification cycles can catch it. Periodic access reviews were designed for slower operating models where entitlement state remained stable long enough to be sampled. In cloud, SaaS, NHI, and agentic AI environments, that assumption breaks because access can appear, expand, and disappear between review windows. Practitioners should stop treating certification as the primary control and start treating it as a downstream assurance step.
A few things that frame the scale:
- Nearly 60% of IT leaders cite restrictive cost and complexity as a weakness of legacy identity governance, according to the 2025 State of Identity Governance Report.
A question worth separating out:
Q: How do you know if identity governance is keeping up with access change?
A: Look for shrinking numbers of dormant accounts, faster offboarding, fewer conflicting entitlements, and cleaner audit outcomes. If access review results keep surfacing the same exceptions, the programme is lagging behind identity growth. Good governance reduces the amount of manual cleanup needed after each review cycle.
👉 Read our full editorial: The state of identity governance 2026 shows IGA is changing