Topic starter
09/06/2026 11:46 pm
TL;DR: ITSM platforms can route tickets and automate service work, but they do not decide whether access is appropriate, least-privileged, or time-bound, according to Zluri’s comparison of ITSM tools and access governance. That distinction matters because access control needs policy, entitlement logic, and auditability, not just faster ticket handling.
Editorial analysis by NHI Mgmt Group, based on content published by Zluri: “Top 14 IT Service Management Tools (ITSM Tools) in 2026”.
Key questions
Q: What breaks when ITSM handles access requests without a governance layer?
A: The request may be approved and closed, but the organisation still has no assurance that the access is properly scoped, time-limited, or compatible with segregation-of-duties rules.
Q: Why does access request automation still create risk in enterprise IAM?
A: Automation speeds up the handoff, but it does not decide the right entitlement.
Q: How can teams tell whether access governance is actually working?
A: Look for short revocation times, low rates of stale entitlements, and repeatable access review outcomes across systems.
Practitioner guidance
- Separate request routing from entitlement decisions Keep ITSM as the intake and tracking layer, but require a policy engine to decide access scope, approval depth, and rejection conditions before fulfilment.
- Define role and risk-based approval rules Map each application to explicit rules for auto-approval, single approval, multi-level approval, or rejection based on role, department, and sensitivity.
- Enforce automatic expiry for temporary access Make project-based and exception-based access time-bound so permissions are removed when the business need ends, without relying on manual ticket closure.
Bottom line: ITSM tools are built to process work, not to decide whether access should exist, at what level, or for how long.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 4 days ago by NHI Mgmt Group
10/06/2026 2:15 am
ITSM-based access management creates a governance illusion: a completed ticket looks like control, but it often only proves that work was routed and closed. Identity governance requires decision quality, entitlement precision, and lifecycle expiry, none of which a generic service desk can infer on its own. The practitioner lesson is that closure is not control when access is the real subject.
A few things that frame the scale:
- 85% of organisations lack full visibility into third-party vendors connected via OAuth apps, according to The State of Non-Human Identity Security.
- That same research found that 45% of organisations cite lack of credential rotation as the top cause of NHI-related attacks, which is a reminder that lifecycle control is still the weak point in many identity programmes.
A question worth separating out:
Q: How do organisations know if access governance is actually working?
A: Look for evidence that requests are resolved with the correct permission tier, temporary access expires automatically, and audits can trace the policy that justified each approval. If the main evidence is still ticket closure, the programme is measuring throughput, not governance quality.
👉 Read our full editorial: ITSM tools are not access governance tools for enterprise identity
10/06/2026 9:25 pm
ITSM access request handling is not an access governance model. Ticketing systems can document requests and approvals, but they do not inherently determine entitlement quality, license scope, or duration. That distinction matters because governance is about deciding the right access, not merely processing the request efficiently. Practitioners should separate service workflow from identity control as a programme design principle.
A few things that frame the scale:
- Gartner predicts that AI systems will initiate 50% of all service requests by 2030, driven largely by agentic AI.
A question worth separating out:
Q: Should organisations use ITSM or IGA for access governance?
A: Use both, but for different jobs. ITSM should route and record the request, while IGA should determine whether the entitlement should exist, what level it should have, and when it should expire or be removed.
👉 Read our full editorial: ITSM tools are not access governance tools for enterprise identity
This post was modified 4 days ago by NHI Mgmt Group