Topic starter
11/08/2026 3:18 pm
TL;DR: Lifecycle events still anchor identity administration, but modern environments need continuous identity state to keep access aligned with current relationships, ownership, policy, and risk, according to Fischer Identity. Event-only models leave drift between reviews and changes, making governance continuous rather than periodic the decisive control.
Editorial analysis by NHI Mgmt Group, based on content published by Fischer Identity: “From Lifecycle Events to Continuous Identity State”.
Key questions
Q: What breaks when device lifecycle management is not tied to identity governance?
A: When device lifecycle management is isolated from identity governance, organisations lose the ability to prove who used the device, what access it carried, and whether retirement actually removed trust.
Q: When should organisations prioritise continuous identity evidence over quarterly access reviews?
A: Prioritise continuous evidence when identities change frequently, access is delegated across cloud and SaaS, or auditors need proof of control operation rather than policy intent.
Q: What are the signs that identity state is drifting out of sync?
A: Look for accounts with expired sponsors, access that no longer matches current role or status, repeated extensions, unresolved ownership, and identities that have changed relationship without corresponding entitlement updates.
Practitioner guidance
- Define current identity state as a governed object Map each identity to current relationship, ownership, sponsorship, access, policy, and risk so governance can evaluate state instead of only events.
- Trigger governance on relationship change Create review, approval, or removal paths that fire when a contractor ends, a role changes, a sponsor lapses, or an AI agent expands scope.
- Model non-human identities separately Treat service accounts, workloads, bots, and AI agents as distinct governed populations with purpose, owner, and lifecycle state, not as exceptions to workforce IAM.
Bottom line: Lifecycle-only IAM breaks down when identity relationships change faster than the next scheduled trigger or review.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
11/08/2026 3:30 pm
Continuous identity state is a governance model, not a workflow enhancement. Event processing is still necessary, but it is no longer sufficient to preserve identity accuracy in environments where relationships change outside the cadence of formal lifecycle triggers. The operational problem is drift between what the system last knew and what the business relationship now justifies. Practitioners should stop treating lifecycle completion as the end state and start treating it as a checkpoint.
A question worth separating out:
Q: Why do service accounts and AI agents need different controls from human users?
A: Service accounts and AI agents authenticate and act without the predictable patterns that human identity systems expect. They can operate across runtimes, scale quickly, and carry permissions into automated workflows. That means access decisions should consider workload context, runtime behaviour, and time-bound authority rather than relying only on user-centric IAM patterns.
👉 Read our full editorial: Continuous identity state is replacing lifecycle-only IAM models