Topic starter
16/01/2026 3:28 pm
TL;DR: SaaS environments fragment identity, permission, and integration data across apps, making it hard to answer basic access questions or spot where risk spreads, according to Obsidian Security. The governance problem is no longer visibility alone, but whether teams can model relationships well enough to automate safely.
Editorial analysis by NHI Mgmt Group, based on content published by Obsidian Security: “From SaaS Sprawl to a Knowledge Graph”.
Key questions
Q: What breaks when SaaS access is reviewed app by app instead of as connected relationships?
A: App-by-app review misses inherited privilege, shared tokens, and delegated access paths that only appear when identities, roles, and integrations are modelled together.
Q: Why do fragmented SaaS identities create more risk than simple account sprawl?
A: Fragmentation matters because risk is created by how accounts, tokens, and integrations relate to each other.
Q: What are the signs that SaaS privilege creep is outpacing governance?
A: Look for dormant accounts that still own resources, role nesting that produces unexpected admin rights, and OAuth or API connections that survive user offboarding.
Practitioner guidance
- Model cross-app identity relationships Build a normalised view of users, service accounts, tokens, roles, groups, and integrations so ownership and inheritance can be traced across SaaS applications.
- Inventory delegated access paths Identify where OAuth grants, API tokens, and app-to-app integrations can still act after the original user context has changed or been removed.
- Rework access reviews around relationships Review effective access by connected path, not by single application record, so nested roles and shared permissions are not missed during certification.
Bottom line: SaaS risk is increasingly hidden in the relationships between identities, permissions, and integrations rather than in any single account or app.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 4 days ago by NHI Mgmt Group
08/10/2026 4:54 pm
Relationship modelling is now the control layer, not just an analytics layer. SaaS security breaks when identities, roles, tokens, and integrations are treated as separate records instead of connected authority chains. A knowledge graph makes ownership, inheritance, and delegation observable across apps, which is what IAM and NHI governance actually needs to enforce trust boundaries. The practitioner conclusion is straightforward: if the relationships are not modelled, the control is only partial.
A few things that frame the scale:
- Only 5.7% of organisations have full visibility into their service accounts, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: Should organisations treat AI agents and service accounts differently in SaaS governance?
A: They should govern them with the same relationship-aware discipline but not the same assumptions. Service accounts usually have more stable ownership and scope, while AI agents can chain access across workflows and integrations in ways that change during execution. That means both need inventory, lifecycle control, and blast-radius analysis, but agent behaviour deserves closer runtime scrutiny.
👉 Read our full editorial: SaaS knowledge graphs are becoming core to NHI governance