Topic starter
28/04/2026 4:49 pm
TL;DR: Enterprises often know who has access but cannot explain why, because approval history, policy versioning, exceptions, and business context are scattered across multiple systems, according to Oleria Security. Identity context graphs turn that trail into queryable governance data, which changes access review, incident response, and audit evidence.
Editorial analysis by NHI Mgmt Group, based on content published by Oleria Security: “The context graph that governs everything”.
Key questions
Q: What breaks when approval history and policy versions are stored in separate systems?
A: Governance breaks because reviewers lose the ability to reconstruct the original decision with confidence.
Q: How do identity context graphs improve access reviews in practice?
A: They give reviewers the context that spreadsheets strip away.
Q: How can organisations govern AI agents that use service accounts and tokens?
A: Treat those credentials as governed non-human identities with lifecycle controls, not as temporary developer conveniences.
Practitioner guidance
- Map approval lineage into one governed structure Connect identities, entitlements, policies, approvals, and exceptions so reviewers can trace why access was granted and under what authority.
- Preserve policy version history with each access grant Record which policy version was active when access was approved so later reviews can judge the grant against the correct rule set.
- Treat exceptions as first-class governance objects Track business justification, approver authority, and expiry for every exception instead of leaving those details in tickets or chat threads.
Bottom line: Access governance fails when the reasons for a grant are scattered across multiple systems instead of preserved as decision data.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 7 days ago by NHI Mgmt Group
06/10/2026 7:18 pm
Identity context graphs turn access governance from record keeping into decision lineage. Most identity programmes can inventory entitlements, but they cannot reliably explain how a specific grant was justified, who approved it, or whether the approval still carries authority. That gap matters because governance without lineage is only partial control. The practitioner conclusion is that explainability must be built into the access model itself, not assembled afterward.
A few things that frame the scale:
- Enterprise AI use rose from 55% of organisations in 2023 to 88% in 2025, according to McKinsey’s Global Surveys on the State of AI.
A question worth separating out:
Q: Who is accountable when a user still has access after their approval context has changed?
A: Accountability sits with the governance process that allowed the access trail to fragment. If approver authority, policy version, or exception ownership is not preserved, no reviewer can reliably determine whether the access remains valid. That is a governance design failure, not just an administrative miss.
👉 Read our full editorial: Identity context graphs make access decisions explainable