Topic starter
22/02/2026 9:27 pm
TL;DR: Identity governance is shifting from manual access administration to a structured control layer for employees, contractors, service accounts, and AI agents, according to SafePaaS. As access sprawl and SoD risk grow, the real control problem is proving who can do what, why, and for how long.
Editorial analysis by NHI Mgmt Group, based on content published by SafePaaS: “What is a Segregation of Duties Matrix”.
Key questions
Q: What breaks when segregation of duties is the only control in place?
A: SoD blocks some toxic combinations, but it does not clean up stale, unused, or orphaned access.
Q: Why do identity governance failures create audit and compliance risk?
A: Because auditors need evidence that access was approved, appropriate, and reviewed, not just technically granted.
Q: How do security teams know when access review processes are not enough?
A: When reviews are happening but high-risk access, role creep, or orphaned accounts keep reappearing, the programme is checking records rather than controlling outcomes.
Practitioner guidance
- Define SoD matrices around business transactions Start with high-risk business flows such as vendor setup, payment approval, journal posting, and procurement changes.
- Centralise approval and certification evidence Replace ticket trails, email approvals, and spreadsheets with a governed record of who approved access, when it was reviewed, and why it remains appropriate.
- Extend lifecycle governance to non-human identities Bring service accounts and AI agents into the same joiner mover leaver logic used for people, including ownership, review cadence, and revocation triggers when the task, role, or system relationship changes.
Bottom line: Identity governance is becoming the control layer that makes access decisions provable, reviewable, and tied to business risk.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
06/10/2026 3:28 pm
Identity governance is becoming the only practical way to make access decisions defensible at scale. Authentication proves who logged in, but it does not prove whether the access was approved, appropriate, or still valid. As business applications, SaaS, and cloud estates fragment entitlement ownership, the governance problem becomes one of evidence and accountability, not just enforcement. Practitioners should treat governance as the control that keeps access from becoming an unreviewed accumulation of exceptions.
A question worth separating out:
Q: Why do service accounts and AI agents need different controls from human users?
A: Service accounts and AI agents authenticate and act without the predictable patterns that human identity systems expect. They can operate across runtimes, scale quickly, and carry permissions into automated workflows. That means access decisions should consider workload context, runtime behaviour, and time-bound authority rather than relying only on user-centric IAM patterns.
👉 Read our full editorial: Identity governance and SoD matrices are becoming AI-era controls