Topic starter
15/08/2026 8:29 pm
TL;DR: Identity programmes can process millions of accounts and still leave critical applications, entitlements and non-human identities outside effective governance, according to SafePaaS. The real measure of scale is time to governance coverage across business boundaries, because administration that outpaces policy is not control.
Editorial analysis by NHI Mgmt Group, based on content published by SafePaaS: “Identity Governance at Scale: Why Identity Volume Is the Wrong Measure”.
Key questions
Q: How do I tell whether identity governance is scaling or just administration?
A: Look at coverage, not account volume.
Q: Why do large identity platforms still leave access risk unresolved?
A: Because platform size does not guarantee entitlement depth or business context.
Q: What breaks when non-human identities are left out of governance?
A: When non-human identities are left out, ownership becomes unclear, credentials stay active too long, and audit cannot verify who approved the access or why it still exists.
Practitioner guidance
- Measure governance coverage, not just identity count Track what proportion of material applications, entitlements and identity types are actually under consistent policy and evidence, then use that number as the scale metric for the programme.
- Map entitlement depth across critical applications Require reviewers to see the privileges, data access and cross-system combinations behind each role so approvals are based on effective access rather than role labels alone.
- Bring non-human identities into the review model Extend ownership, certification and retirement processes to service accounts, bots, API credentials and AI agents so machine identities are not left outside the governance scope.
Bottom line: Identity scale should be judged by how much material access is governed, not by how many accounts a platform can store.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
15/08/2026 8:29 pm
Identity scale is fundamentally a governance coverage problem. Enterprises do not fail because they cannot store enough accounts; they fail because material access remains outside auditable policy. Once that happens, headcount growth is a distraction, because the real issue is whether the organisation can govern every important entitlement across every material application.
A few things that frame the scale:
- NHIs outnumber human identities by 25x to 50x in modern enterprises, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: How should teams prioritise governance after an acquisition or major application change?
A: Start with the applications and entitlements that can affect financial reporting, sensitive data or critical operations. Those areas define the real risk surface, and they should move into policy before lower-value systems. The goal is to reduce time to coverage, not to rebuild the identity model from scratch.
👉 Read our full editorial: Identity scale is a governance problem, not a headcount problem