Topic starter
10/06/2026 12:20 am
TL;DR: Traditional IAM automation works best where APIs and connectors exist, but non-integrated portals, vendor-managed systems, and legacy UI applications still create execution gaps that turn policy into manual work, brittle RPA, and audit risk, according to Opnova. Governance strength now depends on whether controls can execute consistently across the full identity surface, not just the integrated half.
Editorial analysis by NHI Mgmt Group, based on content published by Opnova: “Extending Identity Governance Beyond Integrated Systems”.
Key questions
Q: What breaks when identity governance cannot reach legacy and core systems?
A: Access reviews, entitlement discovery, and compliance evidence all become partial.
Q: Why do integrated platforms create new IAM governance risks?
A: Integrated platforms reduce duplication, but they also concentrate identity, data, and transaction control into one place.
Q: How do security teams know whether enterprise IAM is actually working?
A: They should look for evidence that entitlements are narrow, short-lived, and fully traceable.
Practitioner guidance
- Map the non-integrated control surface Inventory regulatory portals, vendor-managed applications, and legacy UI systems that still require manual or brittle automated execution.
- Separate policy design from execution coverage Document where governance decisions are defined centrally but executed through tickets, RPA, or human handoffs.
- Put traceability around AI-assisted workflows Require step-level evidence for any AI-supported identity action that touches disconnected systems.
Bottom line: The central risk is not a lack of IAM policy, but a lack of reliable execution across the systems where identity is actually enforced.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
11/06/2026 2:05 am
Non-integrated execution is the real IAM control boundary. IAM programmes were built to govern systems that expose structured interfaces, and that assumption no longer matches the enterprise. When policy intent reaches a UI-only or vendor-managed environment, the control no longer acts directly and governance turns into approximation. The implication is that architecture reviews must stop treating integration as an implementation detail and start treating it as the condition that determines whether governance is real.
A few things that frame the scale:
- 96% of organisations store secrets outside of secrets managers in vulnerable locations including code, config files, and CI/CD tools, according to Ultimate Guide to NHIs.
- That same research shows only 5.7% of organisations have full visibility into their service accounts, which is why execution gaps and visibility gaps usually travel together.
A question worth separating out:
Q: What should organisations do first to close identity execution gaps?
A: Start by mapping where identity decisions actually fail to reach the target system, then prioritise the highest-risk workflows such as offboarding, role changes, and regulatory access. The goal is to align policy, execution, and evidence across the full identity lifecycle, especially where external portals and legacy UI systems are involved.
👉 Read our full editorial: Extending IAM beyond APIs exposes the enterprise execution gap
12/06/2026 3:39 am
Identity governance is only as strong as the weakest execution layer. The article is correct to frame the problem as structural, not operational. When policy can be enforced in one environment but degrades into manual handling elsewhere, the organisation no longer has one governance model, it has two. That split creates residual access, inconsistent offboarding, and audit evidence that does not line up across the full identity surface. The practitioner conclusion is simple: governance parity must be measured where execution happens, not where policy is written.
A few things that frame the scale:
- Nearly 60% of IT leaders cite restrictive cost and complexity as a weakness of legacy identity governance, according to the 2025 State of Identity Governance Report.
A question worth separating out:
Q: What should security teams do when AI agents touch disconnected identity workflows?
A: Treat the agent as part of the control path, not a replacement for it. Every AI-assisted action in a disconnected environment needs guardrails, traceability, and a clear human accountable point for exceptions. Without that, automation can spread execution inconsistency faster than the organisation can govern it.
👉 Read our full editorial: Extending IAM beyond APIs exposes the enterprise execution gap