Topic starter
06/11/2026 6:39 pm
TL;DR: Identity management is the practical centre of secure access, according to READI, with automation, least privilege, and continuous review keeping users productive without widening insider risk. The governance problem is not romance or convenience; it is whether access decisions stay precise enough to support trust at scale.
Editorial analysis by NHI Mgmt Group, based on content published by READI: “Love at First Login: Why Identity Management is the True Valentine’s Romance”.
Key questions
Q: How should organisations automate identity lifecycle management without losing governance?
A: Start with the highest-risk joiner-mover-leaver events and define source-of-truth triggers from HR or equivalent systems.
Q: Why does least privilege still fail in real IAM programmes?
A: Least privilege fails when access is granted more broadly than the work requires, then left in place after the need changes.
Q: What is the difference between access review and recertification?
A: An access review is the periodic examination of who has access and whether it is still appropriate.
Practitioner guidance
- Standardise lifecycle-driven access decisions Tie every access grant to a joiner, mover, or leaver event so provisioning, change, and revocation follow the same governed path.
- Remove manual closure from revocation Eliminate email-based or ad hoc handoffs for access removal and make deprovisioning a mandatory workflow with a clear owner.
- Shorten the review interval for high-risk access Increase review frequency for privileged or sensitive entitlements so access drift is corrected before it becomes normalised.
Bottom line: Identity governance weakens when provisioning, review, and revocation are treated as separate workstreams instead of one lifecycle.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
06/11/2026 6:41 pm
Identity governance is only as strong as the lifecycle discipline behind it. READI's framing is a reminder that access control failures often begin long before a breach, when approvals, reviews, and removals are treated as separate tasks instead of one governed lifecycle. That separation creates stale access, unclear ownership, and weak accountability, so practitioners should measure how much of their access estate still depends on manual closure.
A few things that frame the scale:
- 69% of security leaders agree identity management must fundamentally shift to address agentic AI systems, according to the 2026 Infrastructure Identity Survey.
A question worth separating out:
Q: How should security teams handle revocation when ownership is unclear?
A: Security teams should revoke or quarantine the credential first, then assign temporary accountability while they resolve ownership. If the business owner is unclear, they should use the account’s system logs, application registration, secret vault records, pipeline metadata and last-use data to identify a sponsor, then require re-approval before reissuing access. Unknown ownership is a control failure, not a reason to leave access active.
👉 Read our full editorial: Identity management is the control plane for access, review, and trust