How should organisations design identity governance for dynamic work?

How to design identity governance for work that changes day to day

identity governance for dynamic work has to assume that people, teams, projects, and system relationships will change faster than static job labels can. The practical goal is not to precompute every eventual permission. It is to give people enough access to start, constrain what they can do by default, and make it easy to tighten, review, or remove access as the work changes.

A useful design starts with birthright access that is narrow and predictable, then adds role access only where the role is stable enough to justify it. Dynamic work usually needs layered access, not a single entitlement model. That means routine access lives in the role layer, temporary or context-specific access is isolated, and exceptions are treated as separate governed objects rather than informal one-off grants.

That approach is more resilient than trying to force every worker into a fixed entitlement profile. It also creates clearer control points for review and recertification, because the organisation can see which access is standard, which access is conditional, and which access should expire when the task, project, or engagement ends. For a broader operating model, NHIMG’s IAM and IGA Basics is a good reference point for the relationship between access management, governance, and entitlement control.

Why layered access works better than static labels

Dynamic work changes the normal failure mode of identity governance. The main risk is not only excessive access at onboarding, but access that lingers after someone changes teams, picks up a short-term project, or finishes a temporary duty. Static labels tend to overgrant or undergrant because they assume one job family can fully represent actual work. Layered access lets the organisation separate stable access from situational access.

The most useful pattern is to treat role access as the steady state, then add short-duration exceptions when needed. Those exceptions should be explicit, time-bounded, and visible enough to be reviewed independently. This is where a clean entitlement model matters: if temporary access is mixed into the role itself, you lose the ability to tell whether the role is still correct or whether the exception has become permanent drift. NHIMG’s Role Mining and Role Design Guide is useful here because it focuses on keeping roles manageable rather than letting role explosion hide governance problems.

Peer behavior can also help governance teams improve recommendations, but it should be used as decision support, not as an automatic grant mechanism. If comparable users consistently need the same access to do the same work, that is a signal to improve the baseline role or birthright package. If only one person needs it, that points more naturally to an exception or a narrowly scoped entitlement. For ongoing review discipline, NHIMG’s Access Reviews and Certification Guide shows how to keep review campaigns focused on removing access rather than merely confirming it.

What to govern continuously as work shifts

Dynamic work governance should focus on the lifecycle of access, not just the initial grant. The critical control moments are joiner, mover, temporary assignee, and leaver events, because each one can invalidate earlier assumptions about need. If those transitions are not captured quickly, the organisation accumulates stale access, duplicate access paths, and unowned exceptions that no one feels responsible for cleaning up.

That is why exception handling has to be its own governed process. Every exception should have an owner, a reason, an expiry or review point, and a clear rule for removal once the need ends. The practical standard is simple: if access exists because of a temporary work context, it should not survive that context without a new approval. NHIMG’s Joiner-Mover-Leaver (JML) Guide is relevant because dynamic work is really a moving-target lifecycle problem, not just an onboarding problem.

Good governance also needs visibility into whether access patterns are drifting faster than the model can absorb. If teams are constantly requesting exceptions for the same kind of work, the governance model is probably too rigid. If exceptions are rarely removed, the organisation is probably using temporary access as a substitute for role maintenance. NHIMG’s Identity Security Programme Guide helps frame this as an operating-model issue: ownership, process, and review cadence matter as much as the tooling.

Practitioner Guidance

What to prioritise: Separate standard access from temporary access at design time. If a permission is needed regularly enough to appear in multiple exceptions, move it into the role model or birthright set instead of normalising repeated manual grants.

What to verify: Every exception should have an approver, an expiry, and a removal path. If your governance process cannot answer who owns the exception and when it will be rechecked, the control is incomplete.

Decision rule: If the access is stable across the same type of work, govern it as a role. If it is task-bound, time-bound, or person-specific, govern it as an exception with tighter review and a shorter lifespan.

Practitioner takeaway: Dynamic work is easiest to govern when access is designed to decay naturally, because the organisation is controlling change instead of trying to freeze it.

Related resources from NHI Mgmt Group

• Why is it important to integrate identity and data governance?
• Should organisations prioritise external exposure or internal credential governance first?
• Why does hybrid work create more identity governance risk than fully remote work in some organisations?
• How should organisations implement identity and access governance in cloud and remote work environments?