Should organisations treat identity governance as a network problem or an access problem?

Why this is an access control question, not a perimeter question

Identity governance belongs in the access layer because the decision point is no longer “inside” versus “outside.” It is whether a human, service, workload, or agent can authenticate, inherit privilege, and keep using access as systems, vendors, and environments change. That makes governance about entitlements, roles, and lifecycle control, not about assuming a trusted network zone.

Once access becomes distributed, the practical boundary is who can do what, under which assurance level, and for how long. That is why identity and access management, privileged access, and entitlement governance sit closer to the real control surface than network segmentation alone. For a concise overview of that operating model, IAM and IGA Basics is the right starting point.

What changes when the network is no longer the control plane

When organisations treat identity governance as a network issue, they usually overvalue location-based trust and undervalue entitlement quality. But modern environments rely on federated access, SaaS, remote work, APIs, and machine-to-machine connections, so the meaningful questions become whether access is still justified, whether privilege is still minimal, and whether dormant or excessive access has been removed.

This also changes how you think about non-human access. Service accounts, workload identities, API keys, and automation can accumulate standing privilege just like people can, and those accounts often bypass the usual user-centric checks. NHIMG’s What are Non-Human Identities guide helps clarify why governance must extend beyond human users.

In practice, identity governance has to cover provisioning, recertification, role design, privileged elevation, and offboarding together. If those controls are fragmented, the network may still be segmented while access remains over-granted and difficult to attest. That is why access review and lifecycle discipline matter more than inherited trust from a network zone. NHI lifecycle management is one useful lens here, even when the question is broader than NHI itself.

How to frame governance decisions in practice

The best decision rule is simple: if a control changes who can authenticate, elevate, delegate, or keep access over time, it belongs to identity governance first. If it only changes packet flow or network reachability, it is supporting infrastructure, not the primary answer to governance.

That distinction matters because many organisations still use network controls as a proxy for trust, then discover that access sprawl, stale entitlements, and reused credentials have outgrown the perimeter. A stronger model is to govern access at the identity layer, then use the network to reinforce that decision, not replace it. NHIMG’s Access Reviews and Certification Guide is a practical reference for closing that gap.

Risk and Threat Considerations

When identity governance is treated as a network problem, organisations create blind spots around standing privilege, dormant accounts, and reused credentials. Attackers often benefit from that mistake because valid access looks normal on the wire, especially after authentication has already succeeded.

Failure mechanism: The network may be well controlled while excessive or stale entitlements remain active, allowing an attacker or insider to move through authorised channels after initial access, rather than needing to break the perimeter.

Impact: The likely result is lateral movement, privilege abuse, and delayed detection, because defenders are monitoring traffic paths while the real weakness sits in entitlement governance and access reuse.

Practitioner Guidance

What to verify: Confirm that access reviews cover both human and non-human identities, and that the review outcome actually removes access rather than merely documenting it. If access cannot be recertified, revoked, or traced to an owner, the governance model is too network-centric.

What good looks like: Standing privilege is rare, elevation is deliberate, service and workload access has clear ownership, and access changes are tied to joiner-mover-leaver events or equivalent lifecycle triggers. Where this is working, the network enforces boundaries, but the identity layer decides authority.

Practitioner takeaway: Treat the network as a transport and containment layer, but treat identity governance as the place where authority is granted, constrained, and removed.

Related resources from NHI Mgmt Group

• When should organisations treat machine access as a high-risk identity problem?
• Should organisations treat PAM as a vault problem or an identity governance problem?
• Should organisations treat AI agent access and employee onboarding as one governance problem?
• When does a machine identity become a compliance problem?