How should organisations rationalize overlapping identity records into one authoritative identity for access decisions?

Why a single authoritative identity matters for access decisions

Rationalisation is not just deduplication. The real goal is to make one identity record the decision point that reflects the person’s current relationship to the organisation, so access is granted or denied using the full context of employment status, sponsorship, role changes, and entitlement history. That prevents fragmented decisions across HR, student, contractor, and local system records.

A useful authoritative identity is usually a composite view, not a single upstream system copied everywhere. The key design choice is which source is trusted for each attribute, which identifiers remain stable over time, and how conflicts are resolved when systems disagree about name, department, or status.

This is why matching on name alone is brittle. Names change, collide, and appear differently across systems; stable identifiers and trusted source data let teams bind related records to one person without creating accidental merges that would widen access or hide a terminated relationship.

How organisations build the authoritative identity

Teams typically start by defining a source-of-truth hierarchy for core attributes such as legal identity, employment or affiliation status, manager, and organisation. They then link secondary records to that core identity through deterministic identifiers where possible, using probabilistic matching only as a controlled exception for discovery and remediation.

The practical workflow is to normalise incoming records, compare them against existing identity candidates, and decide whether they represent the same real-world person. Where the confidence is high, the records are joined and preserved as references; where confidence is weak, the record should stay separate until reviewed, because false merges are harder to unwind than temporary duplicates.

That model also supports lifecycle control. When a person changes role, leaves one function, or transitions from contractor to employee, the authoritative identity lets teams see every linked entitlement and decide whether access should be inherited, reduced, or revoked.

What good access governance looks like after rationalisation

Once identities are rationalised, access reviews become more meaningful because reviewers can see the full entitlement picture instead of separate fragments. That improves decisions about least privilege, segregation of duties, and whether a user still needs access that was granted under an earlier affiliation or role.

The strongest implementation pattern is to keep the authoritative identity as the business person record and treat connected system records as evidence and context. In practice, that means preserving provenance, source timestamps, and linkage rules so audit teams can explain why two records were merged and which system remains authoritative for each field.

For organisations with many upstream systems, the main operational benefit is consistency. A single identity layer reduces duplicate approvals, mismatched deprovisioning, and the chance that one record still has active access after another record has already been disabled.

Risk and Threat Considerations

Duplicate or poorly matched identities create real exposure because access decisions can drift apart across systems. If a terminated, transferred, or contractor record is not correctly linked, one fragment of the identity can remain active and continue to authenticate or authorize access after the person should no longer have it.

Failure mechanism: Loose matching, stale source data, or conflicting identifiers can cause false merges or missed merges, which in turn produce overgranting, orphaned access, or deprovisioning gaps.

Impact: The organisation may lose visibility into who actually has access, overestimate entitlement cleanup, and create a pathway for unauthorized access that is difficult to detect until an audit or incident exposes it.

Practitioner Guidance

What to prioritise: Make linkage quality and source hierarchy more important than aggressive matching volume. If the authoritative identity cannot explain why a record was joined, it is not ready to drive access decisions.

What to verify: Confirm that the chosen stable identifier survives name changes, role changes, and cross-system duplication, and that every merged record still retains provenance back to the original source.

Common mistake: Treating deduplication as a one-time data cleanup. Authoritative identity only works when joins, splits, and reversals are governed as ongoing lifecycle events, not as an initial migration task.

Practitioner takeaway: The control objective is not to eliminate every duplicate record, but to ensure that one trusted identity view governs access while all related records remain traceable and reversible.

Related resources from NHI Mgmt Group

• When do NHI access reviews create more value than a one-time cleanup?
• How should organisations use identity verification results in access decisions?
• What breaks when organisations try to use one approval step for high risk access decisions?
• How do organisations evaluate whether they need one platform for both data access and identity governance?