Notifications
Clear all
Topic starter
14/07/2026 4:24 pm
TL;DR: Identity governance often fails because policies are documented but not continuously enforced, leaving access drift, stale accounts, and fragmented remediation to accumulate until audit or incident time, according to Josys. Static review cycles cannot keep pace with changing access states, so governance now depends on real-time detection and closed-loop enforcement.
NHIMG editorial — based on content published by Josys: Why Policies are the Missing Layer in Identity Governance
Questions worth separating out
Q: How should security teams reduce identity risk when access changes faster than review cycles?
A: They should move from periodic certification to continuous entitlement governance.
Q: Why do static identity governance processes fail when access changes quickly?
A: Static processes fail because access changes happen in real time while review cycles happen later.
Q: What breaks when policy, detection, and remediation are split across different tools?
A: What breaks is the control loop.
Practitioner guidance
- Map policies to live enforcement points Inventory where access is actually granted, changed, or revoked, then verify each policy has a technical enforcement point in that path.
- Eliminate handoff-driven remediation Collapse policy definition, violation detection, and remediation into one workflow so the same control generates the alert, the action, and the evidence.
- Track policy drift as a control metric Measure the gap between stated policy and observed access state by identity type, application, and risk tier.
What's in the full article
Josys's full blog covers the operational detail this post intentionally leaves for the source:
- The 15+ pre-built policy templates and how they map to SOC 2, ISO 27001, CIS Controls, NIS2, and DORA requirements.
- The policy-building workflow showing trigger, identity selection, application targeting, admin consent, and retrospective application.
- The audit ledger and enforcement dashboard fields used to prove policy checks, exceptions, and remediation actions.
- How the policy engine extends across 350+ native integrations and additional applications through AI Integration Builder.
👉 Read Josys's analysis of why policies are the missing layer in identity governance →
Identity policies and governance drift: why enforcement fails?
Explore further
14/07/2026 4:31 pm
Policy-only governance is a documentation model, not a control model. The article describes a common failure state in IGA: teams define rules, but the rules do not continuously govern live access. That distinction matters because governance that cannot detect drift or trigger action is informational, not operational. Practitioners should stop treating policy libraries as evidence of control maturity.
A few things that frame the scale:
- 1 in 4 organisations are already investing in dedicated NHI security capabilities, with an additional 60% planning to do so within the next twelve months, according to The State of Non-Human Identity Security.
- 85% of organisations lack full visibility into third-party vendors connected via OAuth apps, including 38% with no or low visibility and a further 47% with only partial visibility.
A question worth separating out:
Q: Who should own enforcement when policies cover both human and non-human identities?
A: Ownership should sit with the identity or platform team that can see the full access path, while business and application owners handle exceptions and approvals. That model matters because machine identities, service accounts, and human users fail in different ways, but the enforcement standard must remain consistent across all three.
👉 Read our full editorial: Policies are the missing layer in identity governance
