Topic starter
14/08/2026 6:35 pm
TL;DR: PlainID argues that quarterly access reviews only certify a snapshot, while SaaS permissions, tokens, integrations, and AI agent access continue changing between cycles, leaving contractors, movers, and service accounts outside governance until the next attestation. Snapshot-based certification cannot control a continuously changing SaaS estate.
Editorial analysis by NHI Mgmt Group, based on content published by PlainID: “SaaS Authorization: When Access Reviews Fall Behind”.
Key questions
Q: What breaks when SaaS subscriptions are not tied to access reviews?
A: Orphaned subscriptions and stale entitlements start to accumulate because no one revalidates whether the access still matches the job.
Q: Why do SaaS permissions keep creating risk after a review passes?
A: Because the risk is created by change after the review, not necessarily by the review itself.
Q: How can security teams tell whether privileged access reviews are actually working?
A: They are working when every privileged entitlement is inventoried, every decision is traceable, and revoked access is removed from all connected systems without delay.
Practitioner guidance
- Audit standing SaaS access between certification cycles Identify where access can change after approval, especially for contractors, movers, integrations, service accounts, and AI agents.
- Map non-human identities into the review population Include tokens, service accounts, API-linked access, and agent permissions in the same governance inventory as human users so entitlement drift does not sit outside access review scope.
- Move critical SaaS access to runtime policy enforcement Use policy checks at request time for high-risk applications so access is evaluated against current conditions rather than preserved as a standing grant until the next review.
Bottom line: Quarterly certification can prove that access was checked, but it cannot govern permissions that change after the check.
What's in the full article
PlainID's full article covers the operational detail this post intentionally leaves for the source:
- How runtime authorization is positioned alongside existing identity provider and IGA tooling
- The control flow for enforcing policy at request time across SaaS applications and APIs
- The distinction between access review evidence and live enforcement in a dynamic estate
- How Zero Standing Privilege changes the access model for contractors and AI agents
👉 Read PlainID's analysis of why SaaS access reviews fall behind between cycles →
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
14/08/2026 6:42 pm
Snapshot certification is a governance proof, not a protection mechanism: Access reviews show that access was judged at one moment in time, but they do not govern the hours and days after the attestation. That is a structural limit, not an implementation error. The implication is that certification must be treated as evidence for audit, while enforcement has to happen elsewhere.
A few things that frame the scale:
- The average enterprise SaaS platform connects to 42 or more third-party applications through OAuth tokens, API keys, webhooks and automation platforms.
A question worth separating out:
Q: Should organisations prioritise runtime authorization over traditional access reviews for agents?
A: Yes, when the actor can request, use and release access faster than a review cycle can observe it. Traditional access reviews still matter for governance, but they cannot be the primary control for autonomous execution that changes state within a single task.
👉 Read our full editorial: SaaS access reviews are failing between review cycles