Topic starter
24/06/2026 11:24 pm
TL;DR: Identity Governance and Administration is shifting from a compliance layer to the control plane for Zero Trust, lifecycle automation, and continuous identity risk management as enterprises absorb SaaS sprawl, machine identities, and AI agents, according to Omada Identity's review of the 2025 SPARK Matrix. Static approvals are no longer enough when entitlement complexity, audit pressure, and over-privilege all move faster than manual governance cycles.
Editorial analysis by NHI Mgmt Group, based on content published by Omada Identity: “Inside the SPARK MatrixTM Evaluation: Why Omada Leads the 2025 IGA Market”.
Key questions
Q: How should security teams use IGA as the control plane for identity risk?
A: Treat IGA as the system that defines entitlement policy, lifecycle rules, and review logic across human and non-human identities.
Q: Why do manual access reviews break down as entitlement sprawl grows?
A: Manual reviews break down because the volume of entitlements outpaces human capacity to evaluate them consistently.
Q: What are the signs that IGA governance is not keeping up?
A: Common signs include delayed deprovisioning, recurring role clean-up work, high reviewer fatigue, excessive exception handling, and a growing gap between approved access and actual access patterns.
Practitioner guidance
- Map IGA to the control plane Define IGA as the layer that owns entitlement policy, lifecycle orchestration, and certification logic, then push enforcement into access management and PAM from there.
- Automate joiner-mover-leaver workflows Replace manual approval chains for standard access changes with event-driven rules tied to HR, role, and risk signals so routine changes do not wait for human processing.
- Use role mining to reduce entitlement sprawl Review whether current business roles reflect actual access patterns, then remove redundant entitlements and over-broad combinations that keep accumulating over time.
Bottom line: IGA is moving from a compliance wrapper to the layer that defines and enforces identity policy across the access stack.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
25/06/2026 8:15 am
IGA is no longer a support function, it is the policy engine for identity risk. The article's central claim is that modern identity governance now defines the conditions under which access is issued, modified, reviewed, and removed. That makes IGA the layer where identity policy becomes operational reality across human users, machine identities, and delegated access paths. Practitioners should treat governance design as a control-plane decision, not a downstream admin task.
A few things that frame the scale:
- Nearly 60% of IT leaders cite restrictive cost and complexity as a weakness of legacy identity governance, according to the 2025 State of Identity Governance Report.
A question worth separating out:
Q: Why do service accounts and AI agents need different controls from human users?
A: Service accounts and AI agents authenticate and act without the predictable patterns that human identity systems expect. They can operate across runtimes, scale quickly, and carry permissions into automated workflows. That means access decisions should consider workload context, runtime behaviour, and time-bound authority rather than relying only on user-centric IAM patterns.
👉 Read our full editorial: Why IGA is becoming the control plane for identity risk