Topic starter
11/06/2026 11:55 pm
TL;DR: Many organisations are pushed toward Full IGA by Gartner’s Light IGA decision tree even when budgets, legacy systems, and phased programmes make that path unrealistic, exposing a governance gap between what is deployed and what is actually governed, according to Gathid. The binary choice is useful as a diagnostic, but insufficient as an operating model because contextual visibility and continuous access insight are often missing.
Editorial analysis by NHI Mgmt Group, based on content published by Gathid: “The Gartner Decision Tree: Choosing Between Light and Full IGA”.
Key questions
Q: How should security teams decide whether Light IGA is enough?
A: Start with the hardest application, not the easiest one.
Q: Why do Light IGA programmes still leave access risk behind?
A: Because most light governance tools are optimised for narrower, modern environments and do not fully address cross-source visibility, segregation of duties, or role complexity.
Q: What breaks when organisations try to run full governance with light controls?
A: The model breaks at the point where the team needs continuous context rather than periodic checks.
Practitioner guidance
- Map governance coverage by identity source Identify which systems are actually governed today and which remain outside review, including legacy, contractor, physical, and air-gapped environments.
- Separate diagnostic fit from operating model design Use the Light IGA decision tree to classify requirements, then document the interim controls needed while the long-term platform path is still unfolding.
- Measure access drift across disconnected systems Track where entitlement changes occur without a matching review signal, especially in systems that are not fully integrated with the governance stack.
Bottom line: Light IGA can handle basic governance tasks, but it does not close the visibility gap across legacy, disconnected, and multi-source identity environments.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 1 day ago by NHI Mgmt Group
12/06/2026 8:49 am
Light IGA is a scope-limited governance layer, not a complete identity control model. It can cover basic joiner-mover-leaver workflows and entitlement reviews, but it does not solve role engineering, toxic combination analysis, or governance across disconnected systems. That means the operational boundary is narrower than many programme owners assume. Practitioners should judge it by what it governs continuously, not by what it can touch once.
A few things that frame the scale:
- Nearly 60% of IT leaders cite restrictive cost and complexity as a weakness of legacy identity governance, according to the 2025 State of Identity Governance Report.
A question worth separating out:
Q: What should teams prioritise while waiting for a full IGA rollout?
A: Prioritise the gaps that create the most blind spots first, especially disconnected systems, contractor access, and any source of identity data that is not feeding the governance process. That approach improves control now without forcing the programme into a premature full-suite implementation.
👉 Read our full editorial: Light IGA vs full IGA: the governance gap most enterprises hit
This post was modified 1 day ago by NHI Mgmt Group