Topic starter
06/11/2026 6:38 pm
TL;DR: Modern IGA platforms increasingly span human, non-human and agentic identities, automate provisioning and certification, and promise tighter least privilege, according to Opti. NHI Mgmt Group's view is that the core test is whether governance keeps pace with entitlement drift across fast-changing access paths, not whether reviews exist.
Editorial analysis by NHI Mgmt Group, based on content published by Opti: “IGA Solutions: Key Features, Evolution of IGA & Top 6 Platforms”.
Key questions
Q: How do identity teams reduce the impact of privilege creep?
A: Identity teams reduce the impact of privilege creep by regularly reviewing entitlements, removing excess role grants and replacing always-on admin rights with just-in-time elevation.
Q: Why do access reviews often fail to reduce identity risk?
A: Access reviews fail when they validate stale roles instead of live entitlements.
Q: How do separation of duties controls change for service accounts?
A: Separation of duties for service accounts is enforced by splitting ownership, provisioning, approval, and use so no single administrator can create, approve, and wield the same credential.
Practitioner guidance
- Audit entitlement drift continuously Compare expected access against live permissions for high-change identities, including users, service accounts and automation identities, so drift is detected before it becomes normalised.
- Verify offboarding actually removes access Check that deprovisioning, token revocation and account disablement are confirmed in target systems, not just requested in a workflow.
- Extend SoD rules beyond employee accounts Model conflicting permissions across SaaS roles, privileged cloud access and machine identities, then block combinations that recreate the same control conflict in different systems.
Bottom line: Modern IGA only reduces risk when it governs access state continuously, not just during periodic certification windows.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
06/11/2026 6:42 pm
Modern IGA is no longer just an access review layer. It is becoming the control plane for entitlement state across people, workloads and agentic systems. That shift matters because the hard problem is not issuing access once, but proving the right access still exists for the right reason as systems change. Practitioners should judge IGA by how well it governs state drift, not by how many workflows it automates.
A few things that frame the scale:
- 97% of NHIs carry excessive privileges, increasing unauthorised access and broadening the attack surface, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: What should teams do when access is still lingering after offboarding?
A: Reconcile the identity source of truth against all downstream applications, revoke any entitlement that should have been removed, and verify that logs show the change end to end. If offboarding lingers, the issue is not just one missed account. It usually indicates a broken linkage between HR, IAM, and application provisioning.
👉 Read our full editorial: Modern IGA fails when lifecycle and entitlement drift stay disconnected