Topic starter
22/01/2026 4:49 pm
TL;DR: Traditional IGA can leave API-connected AI tools, service accounts and automated workflows outside governance visibility, according to Omada Identity. That extends the time identities can be misused before review, so access control now has to track execution as well as approval.
Editorial analysis by NHI Mgmt Group, based on content published by Omada Identity: “Why Identity Governance Modernization Can't Wait”.
Key questions
Q: Why does delayed discovery create more security risk in modern IGA?
A: Because automated identities can be created and used well before the next scheduled review.
Q: What are the signs that legacy IGA is no longer keeping up?
A: Common signs include unknown service accounts, AI tools with undocumented API access, manual reconciliation after audits, and review cycles that routinely find access long after it was granted.
Q: What breaks when identity governance does not cover AI agents and service accounts together?
A: Governance breaks at the boundary between approved access and actual execution.
Practitioner guidance
- Inventory non-human identity creation paths Map every place where AI tools, scripts, containers and workflows create service accounts, API keys, tokens or certificates.
- Shift recertification toward continuous discovery Use event-driven discovery and change monitoring so new identities and access changes are surfaced as they happen instead of waiting for quarterly review cycles.
- Tie every API-authenticated workflow to an owner Require business ownership, approval evidence and revocation criteria for each API-backed workflow, especially where AI tools and automation inherit access through shared credentials.
Bottom line: Legacy identity governance struggles most where automation creates access outside its visibility model.
Glossary terms: Identity Governance, Machine Identity, Governance Latency, Continuous visibility
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 1 day ago by NHI Mgmt Group
11/10/2026 10:31 am
Legacy IGA is no longer a complete control boundary. The article describes a world where business teams create access through APIs, AI tools and automation faster than governance systems can inventory it. That means identity governance is now a discovery problem as much as a certification problem. Practitioners should treat unseen non-human identities as ungoverned attack surface, not administrative noise.
A few things that frame the scale:
- NHIs outnumber human identities by 25x to 50x in modern enterprises, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: How should organisations turn compliance risk management into identity governance control?
A: Start by mapping each compliance requirement to a concrete identity control such as access review, revocation, monitoring, or lifecycle ownership. Then define the evidence that proves the control worked in practice. If the programme cannot show who approved access, who removed it, and when, compliance is only partially managed.
👉 Read our full editorial: Identity governance modernization is now a security requirement