The main failure modes are under-linking real identities and over-linking unrelated accounts. Exact-match rules miss aliases, plus-addresses, and convention-based variants. Aggressive thresholds can also suppress legitimate matches, especially when model probabilities are underconfident. The result is either fragmented identities that hide risk or merged identities that pollute downstream access and governance decisions.
Why threshold-heavy identity resolution fails in practice
Thresholds and exact-match rules work best when the data is clean, stable, and consistently formatted. identity resolution usually operates in messier conditions, where naming conventions, aliases, shared inboxes, plus-addressing, abbreviations, and partial records are common. The core failure is not just match quality, it is decision quality: a brittle rule set can be very precise and still be wrong at scale.
When the matching logic is too strict, legitimate records remain split across multiple profiles. When it is too loose, unrelated accounts get fused into one identity. Both errors distort the identity graph, but they do so in different ways, so the operational question is not whether the threshold is high or low, it is whether the rule can absorb real-world variance without inventing relationships.
For teams managing identity data, the key issue is that a matching rule is not just a technical filter, it becomes a governance decision about who is considered the same entity. That means the failure mode is not confined to data quality. It can affect entitlement review, fraud review, customer support, access decisions, and any downstream process that assumes the resolved identity is trustworthy.
Where under-linking and over-linking diverge
Under-linking usually shows up when exact-match logic treats small differences as proof of difference. This is common with aliases, email variations, transposed names, transliteration changes, and convention-based identifiers. The result is identity fragmentation, where the same person or account appears to be several separate entities. That fragmentation can hide risk because analysts do not see the full picture.
Over-linking is the opposite failure. Aggressive thresholds can cause distinct entities to collapse into one profile, especially when signals are correlated but not decisive. Once unrelated records are merged, the system may inherit permissions, history, reputation, or investigation notes that do not truly belong together. The practical danger is that bad linkage is often self-reinforcing, because future decisions trust the merged record as if it were ground truth.
Both failures become worse when the scoring model is poorly calibrated. If probabilities are underconfident, a good match may sit below the cutoff and be rejected. If the cutoff is tuned to maximize recall, false merges increase. For teams building identity pipelines, this is a reminder that a threshold is a policy choice, not an objective truth.
Why the error hurts access, governance, and trust
Identity resolution errors matter because they change how the rest of the system interprets authority and relationship. A split identity can cause missed access reviews, duplicated monitoring, or failure to connect related risk signals. A merged identity can suppress anomalies, misstate privilege, or contaminate governance records with data from the wrong subject. In both cases, the downstream effect is not just inconvenience, it is a distorted control environment.
That is why identity reconciliation should be treated as a control surface, not a cleanup task. In a mature programme, the goal is not perfect matching at any cost. The goal is to preserve enough fidelity that access, review, escalation, and reporting decisions remain defensible even when input data is imperfect. For broader identity governance guidance, see the Identity Security Programme Guide.
Threshold-heavy approaches are also fragile in environments with changing naming patterns, delegated administration, or multiple source systems. A rule that works for one data source may fail when the same entity is represented differently elsewhere. That is why teams should expect reconciliation logic to need human review for edge cases, rather than assuming one cutoff can handle every population and every system.
Risk and Threat Considerations
Identity resolution errors create exposure when they feed other controls that assume a single, stable identity record. Fragmented identities can conceal suspicious behaviour across multiple records, while merged identities can give unrelated activity the appearance of legitimacy. In environments with access governance, that can distort recertification, entitlement review, and anomaly detection.
Failure mechanism: brittle exact-match logic misses legitimate variants, while low-quality similarity thresholds collapse distinct entities into one record; both errors become more damaging as identity data is reused across security and business workflows.
Impact: under-linking can hide risk and delay detection, while over-linking can pollute downstream access and governance decisions, create false confidence in identity completeness, and weaken the reliability of operational controls.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST SP 800-53 Rev 5 and CIS Controls v8 set the technical controls, while ISO/IEC 27001:2022 defines the regulatory obligations.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev 5 | IA-5 — Authenticator Management | Identity resolution errors often arise from poor lifecycle handling of identity-bearing material. |
| AC-2 — Account Management | Resolved identity quality directly affects account governance and review decisions. | |
| AU-6 — Audit Record Review, Analysis, and Reporting | Merged or fragmented identities distort log review and alert correlation. | |
| Recommendation — Manage credential lifecycle tightly so identity records and authenticators stay correctly associated. Keep account records accurate and reconcile duplicates before access decisions or recertification. Correlate events to validated identity records before trusting audit analysis. | ||
| ISO/IEC 27001:2022 | A.5.16 — Identity management | Identity resolution is a direct identity-management control concern. |
| Recommendation — Define reconciliation rules and ownership so identity records remain accurate and trustworthy. | ||
| CIS Controls v8 | 5 — Account Management | Accurate account inventory and lifecycle control reduce duplicate or merged identity records. |
| Recommendation — Continuously inventory and validate identities to prevent duplicate or stale account records. | ||
Practitioner Guidance
What to prioritize: treat false merges as higher blast-radius events than simple missed matches, because a bad merge can misstate authority, ownership, and history across multiple downstream systems. If a resolved identity can influence access, investigation, or approval, it needs a tighter review path than ordinary deduplication.
What to verify: test the matching policy against known edge cases, especially aliases, plus-addressing, shared naming conventions, transliteration, and cross-system identifier drift. A useful rule is that any record pair with high business impact but borderline similarity should be routed to review, not silently auto-merged.
Practitioner takeaway: the best identity resolution control is usually not a single threshold, but a decision model that preserves precision where the consequence of a false merge is high and preserves recall where fragmented identities would hide material risk.
Related resources from NHI Mgmt Group
- What are the main failure modes teams should expect when installing MCP servers in coding agents?
- What breaks when bot detection relies too heavily on static rules?
- What breaks when content inspection relies too heavily on keywords, RegEx, or exact data matching?
- What breaks when identity proofing relies too heavily on device level biometrics?
Deepen Your Knowledge
Reviewed and updated by the NHIMG editorial team on September 30, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org
