Topic starter
11/06/2026 11:45 pm
TL;DR: Traditional IGA tools that rely on HR or directory syncs struggle in SaaS-heavy environments with contractors, bots, APIs, and service accounts, according to Zluri. The governance shift is toward a real-time system of record that correlates identity context, access, and usage before stale entitlements create audit and security gaps.
Editorial analysis by NHI Mgmt Group, based on content published by Zluri: “Next Gen IGA As A System of Record”.
Key questions
Q: What breaks when IGA depends on HR or directory syncs for access truth?
A: The control breaks at speed and completeness.
Q: Why do stale entitlements create audit and security risk?
A: Stale entitlements keep permissions attached to users after their roles change, which increases the chance of overprivilege, misuse, and failed least-privilege evidence.
Q: How should teams judge whether an IGA programme is actually modern?
A: They should look for three things: broad integration across identity sources, reliable automation across the lifecycle, and reporting that ties governance to business outcomes.
Practitioner guidance
- Define the system of record boundary Document which platform owns authoritative access state for each identity class, then route governance decisions to that source rather than waiting on periodic downstream syncs.
- Correlate identity fragments into one graph Join HR, directory, SaaS, and app-level access records so reviews can show who the identity is, what it can reach, and why the access exists.
- Move from schedule-driven to signal-driven reviews Trigger recertification, revocation, and exception handling from role change, inactivity, contractor end-date, and direct-app-grant signals instead of fixed review cycles.
Bottom line: Traditional IGA fails when it treats HR and directory feeds as sufficient truth for access governance.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 4 days ago by NHI Mgmt Group
12/06/2026 8:34 am
System of record is now a governance requirement, not a reporting convenience: Identity programmes that depend on external systems for truth are already operating with a lag that weakens revocation, certification, and audit defensibility. In SaaS-heavy estates, the governance layer must own the authoritative context or it is only replaying yesterday’s identity state. Practitioners should treat the control plane, not the HR feed, as the point where access decisions are made.
A few things that frame the scale:
- Nearly 60% of IT leaders cite restrictive cost and complexity as a weakness of legacy identity governance, according to the 2025 State of Identity Governance Report.
A question worth separating out:
Q: How should organisations govern non-human identities across their environment?
A: Start by inventorying every machine identity, assigning a human owner, and tying each one to a business purpose. Then apply routine access review, least privilege, and revocation for stale accounts. NHIs should be governed as accountable identities, not as background infrastructure that can be left unmanaged.
👉 Read our full editorial: Next-gen IGA as system of record for human and NHI access
This post was modified 4 days ago by NHI Mgmt Group