What breaks when access reviews are still manual in a zero trust model?

Why This Matters for Security Teams

Manual access reviews break down first in zero trust programmes because they assume identities, entitlements, and risk stay stable long enough for periodic certification to mean something. They do not. Zero trust expects continuous verification, while manual review cycles create gaps between what is approved and what is actually active. That gap is where excessive privilege, stale access, and unreviewed service accounts persist. NHI Mgmt Group notes that 90% of IT leaders say properly managing NHIs is essential for a successful zero-trust implementation in the Ultimate Guide to NHIs, which reflects how central governance has become to the model.

For human users, a delayed review is already a control weakness. For NHIs and agentic workloads, it is worse because access can be created, chained, and reused automatically across tools and environments. The zero trust model described in NIST SP 800-207 Zero Trust Architecture depends on policy being enforced at request time, not only at audit time. In practice, many security teams encounter privileged drift and invalid attestations only after an incident has already shown the gap, rather than through intentional governance.

How It Works in Practice

In a working zero trust model, access review is not a quarterly spreadsheet exercise. It is a control loop embedded in the identity plane, policy engine, and telemetry pipeline. The review function should draw from live evidence: who or what the identity is, which workload or agent is acting, what it is trying to access, and whether the current session matches expected behaviour. That is why current guidance increasingly favours continuous authorisation over periodic recertification, especially for non-human identities. The OWASP Non-Human Identity Top 10 highlights identity lifecycle and secret handling risks that manual review often misses.

A practical design usually includes:

• Continuous entitlement discovery across cloud, SaaS, CI/CD, and infrastructure permissions.
• Policy-as-code checks at request time using context such as device posture, workload identity, time, and resource sensitivity.
• Automated flagging of stale, unused, or orphaned access for immediate remediation.
• Evidence generation from logs, policy decisions, and revocation events rather than post-hoc screenshots.

For NHIs, the review must also include credential shape and lifecycle. Long-lived secrets create review debt because the access may outlive the business justification. Linking governance to lifecycle management, as outlined in the NHI Lifecycle Management Guide, helps convert review findings into revocation, rotation, or re-issuance instead of status-only approval. Where workload identity is used, services such as SPIFFE and SPIRE can make the subject of the review cryptographically explicit, which improves evidence quality and reduces ambiguity in approvals, as discussed in the Guide to SPIFFE and SPIRE. These controls tend to break down when entitlements are aggregated across legacy systems that cannot emit real-time access telemetry because the review process has no trustworthy source of current state.

Common Variations and Edge Cases

Tighter continuous review often increases operational overhead, so organisations must balance assurance against the effort needed to maintain clean telemetry, policy logic, and ownership data. In mature environments, this tradeoff is usually worth it. In mixed environments, it can be harder to sustain.

There is no universal standard for which access decisions must be real time and which can remain periodic. Current guidance suggests using higher-frequency or event-driven review for privileged roles, service accounts, API keys, and agentic workloads, while lower-risk business apps may still use periodic certification. The important distinction is that zero trust does not rely on manual review as the primary safety net. It uses it as a backstop.

Edge cases appear when access is temporary, federated, or delegated across suppliers. Third-party NHIs and automation accounts can be especially difficult to classify, and manual reviewers often approve them because the business owner is not clear or the entitlement is buried inside another platform. NHI Mgmt Group’s 52 NHI Breaches Analysis shows how often weak lifecycle control and poor visibility turn review gaps into lasting exposure. Where the environment cannot support automated evidence, the review process should be treated as incomplete rather than compliant.

Related resources from NHI Mgmt Group

• What is the difference between JIT access and Zero Trust for NHIs?
• What breaks when user access reviews are still manual in hybrid environments?
• What breaks when access reviews are still mostly manual?
• What breaks when access policies are not continuously revalidated in a Zero Trust model?