What breaks when application builders expose authentication setup to every downstream app team?

Why This Matters for Security Teams

When every downstream app team is allowed to design its own authentication setup, the result is not flexibility but drift. Sign-in flows, sign-up rules, enterprise federation, and exception handling start to diverge, which makes policy enforcement inconsistent and auditing harder. That is especially risky for application onboarding, where identity controls should be predictable and repeatable, not reimplemented per team.

Security teams also lose the ability to prove baseline controls across the portfolio. NHI Mgmt Group notes that 79% of organisations have experienced secrets leaks, with 77% causing tangible damage in Ultimate Guide to NHIs — Why NHI Security Matters Now, which shows how quickly inconsistent identity handling becomes an incident pathway. A similar pattern appears when app teams choose local auth libraries, bespoke policy logic, or ad hoc enterprise sign-in exceptions instead of standard controls. Current guidance from NIST SP 800-53 Rev 5 Security and Privacy Controls favours centrally governed access controls and consistent enforcement over fragmented implementation.

In practice, many security teams encounter identity sprawl only after the first policy exception, integration shortcut, or audit finding has already exposed the control gap.

How It Works in Practice

The safer pattern is to centralise authentication primitives while letting application teams consume them through standard interfaces. That means the platform or identity team owns the control plane for sign-in, sign-up, federation, session policy, and enterprise authentication defaults, while product teams configure approved parameters rather than building their own flow. This reduces variation without blocking delivery.

Practically, the design should separate what is centrally enforced from what is app-specific. Core controls usually include identity proofing, SSO federation, MFA requirements, password or passwordless defaults, callback validation, session lifetime, and approved identity providers. App teams can then select from sanctioned options, such as whether an application is internal or customer-facing, but they should not define their own authentication architecture.

• Use a shared authentication service or gateway with standard defaults.
• Pre-approve enterprise identity providers and federation patterns.
• Expose policy as configuration, not as custom code in each app.
• Log authentication events centrally for detection, response, and audit.
• Restrict exceptions to time-bound, documented approvals.

This model aligns with the intent of NIST SP 800-53 Rev 5, which treats access control, identification, and authentication as governed capabilities rather than optional implementation details. It also matches the lessons in 52 NHI Breaches Analysis, where weak identity discipline repeatedly amplifies downstream compromise. These controls tend to break down in highly heterogeneous estates where legacy apps, mergers, or embedded third-party sign-in requirements force multiple incompatible auth stacks.

Common Variations and Edge Cases

Tighter central authentication often increases platform overhead, so organisations must balance standardisation against migration cost and team autonomy. That tradeoff is real, especially when legacy applications cannot immediately adopt the same sign-in flow as modern services.

Best practice is evolving for customer identity, partner federation, and B2B onboarding, where the right control set may differ by trust boundary. Some teams will need approved exceptions for regional identity providers, regulated business units, or offline recovery paths. The key is to make those exceptions visible, time-limited, and reviewable instead of letting each app team invent its own model.

Security teams should also distinguish between user-facing authentication and machine identity. If downstream teams are handling service accounts, tokens, or API keys in the same local way they handle human sign-in, the risk escalates quickly. NHI Mgmt Group highlights in Ultimate Guide to NHIs — Why NHI Security Matters Now that NHIs are often overprivileged and poorly governed, which is why authentication sprawl can become a broader identity problem, not just an app onboarding issue. Current guidance suggests that the more sensitive the application, the less room there should be for local auth customisation.

Related resources from NHI Mgmt Group

• What breaks when authentication depends on multiple apps and time-sensitive steps?
• How should security teams handle authentication and authorization for AI and application integrations without adding unnecessary token exchange complexity?
• Why is it crucial to adopt new authentication methods in MCP usage?
• What breaks when every agent in a team can call the same tools?