Notifications
Clear all
Topic starter
17/08/2026 4:41 pm
TL;DR: An API-first developer ecosystem can extend identity security by letting teams build, certify, and distribute integrations across disconnected, legacy, and SaaS applications, while also exposing how much governance depends on connector quality and lifecycle discipline, according to Saviynt. The real issue is not extensibility itself, but whether JML, approvals, and access controls remain enforceable once integrations move into a shared marketplace model.
NHIMG editorial — based on content published by Saviynt: Innovate, Build, Share: Discover the Saviynt Exchange Open Developer Ecosystem
By the numbers:
- Saviynt Exchange currently features over 400 apps and solutions in its developer marketplace.
- Only 5.7% of organisations have full visibility into their service accounts.
- 96% of organisations store secrets outside of secrets managers in vulnerable locations including code, config files, and CI/CD tools.
Questions worth separating out
Q: How should security teams govern partner-built identity integrations?
A: Security teams should govern partner-built identity integrations as part of the control plane, not as standalone add-ons.
Q: Why do disconnected applications create identity governance risk?
A: They create risk because the organisation cannot reliably see, certify, or revoke access through the same control plane used for integrated systems.
Q: What breaks when access approvals move into collaboration tools?
A: What breaks is the assumption that the approval record, the entitlement state, and the audit trail all stay aligned.
Practitioner guidance
- Inventory every marketplace integration Classify each app, connector, and SDK extension by data access, entitlement scope, and owner.
- Tie partner apps to lifecycle controls Map joiner, mover, and leaver events to the same identity source of truth across legacy and SaaS targets.
- Audit delegated approval workflows Review approvals that occur in messaging platforms or external workflows to confirm they still feed certification, audit, and revocation processes.
What's in the full article
Saviynt's full blog post covers the operational detail this post intentionally leaves for the source:
- Step-by-step examples of how partners use REST APIs, SDKs, and the extension framework to build connector workflows.
- Named partner use cases for disconnected apps, messaging-based approvals, and mainframe integration.
- Marketplace certification and distribution details for apps that are built to be shared or resold.
- Specific examples of how continuous access evaluation interops with the platform's ecosystem.
👉 Read Saviynt's blog post on the Exchange developer ecosystem and app marketplace →
Saviynt Exchange and the governance gap in app onboarding?
Explore further
View Full Forum → | NHI Foundation Course → | Our Services →
17/08/2026 4:46 pm
Marketplace scale changes the governance problem, not just the delivery model. Once an identity platform exposes a developer ecosystem with hundreds of shared apps, the control question shifts from configuration to provenance. The issue is no longer whether the core platform can govern access, but whether every third-party integration inherits the same lifecycle and policy discipline. Practitioners should treat marketplace growth as an expansion of the identity estate, not a side channel.
A few things that frame the scale:
- Only 5.7% of organisations have full visibility into their service accounts, according to Ultimate Guide to NHIs.
- 96% of organisations store secrets outside of secrets managers in vulnerable locations including code, config files, and CI/CD tools.
A question worth separating out:
Q: How can security teams keep marketplace extensibility under control?
A: By separating development freedom from governance authority. Teams should allow apps to be built and shared, while still enforcing least privilege, code review, audit logging, and lifecycle ownership. Marketplace scale is manageable only when every extension has a named accountable owner and a tested path for removal or rollback.
👉 Read our full editorial: Developer ecosystems are reshaping identity governance and app onboarding
