For high-risk non-human identities and AI agents, yes. Quarterly reviews still matter for accountability, but they are too slow to catch access misuse that emerges during runtime, especially in cloud and SaaS environments.
Why Continuous Governance Beats a Calendar-Only Review
Quarterly access reviews still have a place for accountability, but they are a weak primary control when privileges can be created, expanded, chained, and abused between review cycles. For NHI and agentic workloads, the security question is not whether access was approved once; it is whether the access remains appropriate at runtime, under changing workloads, vendors, tokens, and tool paths.
That matters most in cloud and SaaS environments where permissions are often inherited, delegated, or attached to service accounts that no business owner watches every day. When monitoring is absent or rotation is delayed, dormant access can become active exposure without any formal policy change. NHIMG research on NHI security also shows how common this gap is: 1 in 4 organisations are investing in dedicated NHI security capabilities, while 60% more plan to do so within a year.
The practical issue is that quarterly review cadence assumes access risk is mostly static. It is not. Runtime governance has to absorb new secrets, new integrations, new agent actions, and new privilege paths as they appear. In practice, many security teams discover excessive access only after a workload has already used it in ways the last review never anticipated.
How Continuous Governance Works in Practice
Continuous governance means treating access as a living state, not a quarterly attestation event. The control model shifts from asking who had access at one point in time to asking whether the identity, secret, policy, and usage pattern are still consistent with approved intent right now. For NHI, that usually requires inventory, ownership, short-lived credentials where possible, monitoring of unusual use, and enforcement that can react faster than human review cycles.
In agentic and machine-to-machine environments, the most effective programmes combine three layers. First, they establish a current inventory of NHIs, tokens, API keys, certificates, and delegated app grants. Second, they evaluate runtime signals such as token age, privilege scope, cross-environment reach, and anomalous calls. Third, they automate revocation, rotation, or step-up approval when the observed state drifts from expected use. That is why lifecycle governance is more than audit support; it is the operating model that keeps review evidence aligned with actual access.
Quarterly review still contributes value, but mainly as a control for ownership, exception handling, and attestation. It should confirm that the continuous controls are working, not substitute for them. The governance pattern is especially important for third-party OAuth applications and other delegated access paths, where access can remain active long after the original business need changes. NHIMG’s NHI research highlights this visibility problem, with 85% of organisations lacking full visibility into third-party vendors connected via OAuth apps.
- Use runtime signals to detect when an identity’s effective privilege no longer matches its approved purpose.
- Prefer short-lived credentials and rapid rotation for high-risk non-human identities.
- Bind exception handling to ownership so unresolved access does not persist by default.
- Keep quarterly reviews as a validation layer, not the first line of defence.
These controls tend to break down when teams cannot see delegated access paths across SaaS, cloud, and automation platforms because the governance model loses the ability to react before misuse becomes persistent.
Common Variations and Edge Cases
Tighter governance often increases operational overhead, so organisations have to balance responsiveness against review burden. The right cadence depends on how quickly access can change, how much privilege the identity carries, and whether the workload can cause material impact without human intervention.
There is no universal standard that says quarterly reviews are obsolete in every environment. For low-risk, tightly scoped accounts, a quarterly attestation may be sufficient if paired with strong logging and low blast radius. For high-risk NHIs, admin-like service accounts, externally delegated access, and AI agents with tool execution, current guidance suggests the interval should be much shorter, and in some cases event-driven rather than calendar-driven.
A common mistake is to treat continuous governance as a reporting dashboard. A dashboard does not reduce exposure unless it is connected to enforcement. Another is to over-focus on the review process itself while leaving long-lived credentials untouched. When the underlying secret can still authenticate, the review is only describing a risk that remains live.
If the organisation cannot yet automate revocation or rotation, the next best step is to tighten ownership, reduce privilege, and narrow token lifetime before expecting quarterly governance to do meaningful work.
Risk and Threat Considerations
Calendar-only access reviews create a window in which excessive privilege, stale delegation, and compromised credentials can be abused before anyone revalidates them. That is a governance risk and a threat-exposure problem, not just an audit weakness.
Failure mechanism: An attacker, rogue integrator, or overextended automation path can use standing access, inherited permissions, or long-lived secrets to act between review cycles. In cloud and SaaS environments, that access can be chained into persistence, lateral movement, or repeated API activity before the next attestation.
Impact: The result can be unauthorised data access, unapproved transactions, service manipulation, or a breach that appears “approved” on paper even though the runtime state had already drifted out of control.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 and MITRE ATT&CK address the attack and risk surface, while CIS Controls v8 and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-01 — Secrets and Credential Management | Continuous governance depends on rotating and monitoring non-human credentials before misuse persists. |
| NHI-03 — Privilege and Access Scope | Quarterly reviews are too slow when NHI privilege can expand or overreach between attestations. | |
| NHI-06 — Lifecycle Management | The question turns on governing access as a live lifecycle state, not a quarterly event. | |
| Recommendation — Rotate high-risk NHI secrets quickly and monitor their runtime use continuously. Continuously enforce least privilege and remove excess NHI access as soon as scope drifts. Maintain current NHI inventory, ownership, and revocation paths across the full lifecycle. | ||
| CIS Controls v8 | 5 — Account Management | Continuous governance needs timely account review, disablement, and exception handling for active access. |
| 6 — Access Control Management | The issue is ongoing enforcement of who can access what, rather than periodic paper approval. | |
| Recommendation — Continuously review and disable unnecessary accounts and access paths without waiting for quarterly cycles. Enforce access decisions in real time and revoke privileges when they no longer match approved need. | ||
| NIST CSF 2.0 | PR.AA — Identity Management, Authentication and Access Control | Continuous governance aligns with maintaining access integrity as conditions change over time. |
| DE.CM — Continuous Monitoring | Runtime governance requires monitoring that detects drift between approved and actual access use. | |
| Recommendation — Continuously validate identity state and adjust access when authentication or authorization conditions change. Monitor NHI and agent access activity continuously and act on anomalous or unexpected behavior. | ||
| MITRE ATT&CK | T1078 — Valid Accounts | Stale or overprivileged accounts and secrets are attractive persistence paths between review cycles. |
| Recommendation — Detect and constrain valid-account abuse by alerting on abnormal use of standing access. | ||
Practitioner Guidance
What to prioritise: Put continuous controls on the identities that can cause the most damage if misused, especially privileged NHIs, delegated SaaS apps, and agents with tool access. Quarterly review should follow those controls, not replace them.
Decision rule: If an identity can authenticate without frequent human touch, or if its privilege can change through delegation or automation, treat it as a continuous-governance candidate. If it cannot cause material impact, a slower attestation cadence may be acceptable.
What to verify: Verify that ownership, credential lifetime, effective privilege, and runtime use all match. If any one of those drifts, the access state is no longer trustworthy even if the last review was clean.
Practitioner takeaway: The real decision is not “continuous governance or quarterly reviews”; it is whether quarterly reviews are being used as the control or merely as evidence that the control is working.
Related resources from NHI Mgmt Group
- When should organisations prioritise data access governance over more IAM roles and reviews?
- Should organisations prioritise external exposure or internal credential governance first?
- When should organisations prioritise NHI lifecycle governance over more access tooling?
- When should organisations prioritise discovery over access reviews?
Deepen Your Knowledge
Reviewed and updated by the NHIMG editorial team on September 6, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org
