Identity lifecycle management: what IAM teams are missing today

TL;DR: Traditional IAM tools can support onboarding and offboarding, but they do not continuously govern the full identity lifecycle across humans, service accounts, and AI agents, according to Opal Security. Lifecycle drift, orphaned access, and brittle policy logic are now core governance problems, not edge cases.

NHIMG editorial — based on content published by Opal Security: How Opal Streamlines Identity Lifecycle Management

Questions worth separating out

Q: How should security teams govern identity lifecycle across humans and non-human identities?

A: Security teams should govern lifecycle with one model and different triggers.

Q: Why do orphaned accounts remain a major IAM risk?

A: Orphaned accounts remain risky because access often outlives the business reason for it.

Q: What do organisations get wrong about access reviews?

A: They often treat access reviews as a substitute for lifecycle control.

Practitioner guidance

• Inventory every identity subject by lifecycle owner Build a register that separates humans, service accounts, contractors, and AI agents, then assign an accountable owner to each subject and its downstream accounts.
• Tie entitlement changes to authoritative events Trigger provisioning, updates, and revocation from authoritative lifecycle events such as HR status changes, approved requests, application decommissioning, or agent retirement.
• Add review thresholds for high-impact access changes Pause or require approval for broad entitlement changes, especially where a single policy update can affect many users or many connected systems.

What's in the full article

Opal Security's full post covers the operational detail this post intentionally leaves for the source:

• Step-by-step examples of joiner, mover, and leaver workflows across connected applications.
• Specific guardrail logic for pausing high-impact entitlement changes before they cascade.
• Operational details on how account provisioning and deprovisioning are tied to lifecycle events.
• Inventory and risk center behaviours for surfacing overlapping policies and stale access.

👉 Read Opal Security's analysis of identity lifecycle management across human and machine identities →

Identity lifecycle management: what IAM teams are missing today?

Explore further

View Full Forum →  |  NHI Foundation Course →