What breaks when IAM tools only review policy intent?

Why policy intent is the wrong unit of review

policy intent tells you what was requested, not what the environment can actually do once inheritance, delegation and composite roles are applied. The control decision changes as soon as permissions are accumulated across systems, nested groups, cross-account trusts or indirect role grants. Effective authority is the real security object, because that is what determines whether a subject can read, change, approve or impersonate something.

Intent-only review is especially fragile in environments with separate policy engines or identity planes. A request can look clean in one system while another system quietly adds reach through group nesting, delegated admin, role chaining or cross-boundary trust. That is why effective access analysis must evaluate the complete authority graph, not a single approval record.

A useful way to think about the problem is that approved access is an event, while effective control is a state. The state can outlive the request, expand through inheritance, or change when another administrator modifies a parent role or trust relationship. That means the review process has to answer, “what can this actor actually do right now?” not “what did someone approve last week?”

Where hidden authority appears in practice

The most common failure mode is role composition. A low-risk looking role becomes powerful when combined with another role, a nested group, or a delegated scope that was not visible in the original ticket. Cross-account trusts and federation links make this worse because the effective reach may cross administrative boundaries while still appearing legitimate on paper.

Another source of hidden authority is delayed propagation. A policy change may look correct at approval time, but inherited memberships, cached entitlements or synchronised directory state can preserve access longer than expected. In those cases the governance gap is not that the policy was denied, but that the review model never observed the system in its final effective state.

For identity governance work, the practical baseline is to inspect the authority path, not just the entitlement label. NHI Management Group’s IAM and IGA Basics is a useful starting point because it frames access review around entitlements, access certification and the difference between authorization logic and the request record. Where the problem extends into cross-system reach, NHI Management Group’s Cloud PAM and CIEM Guide is directly relevant because effective permissions and escalation paths are what expose the real blast radius.

Intent-only review also misses the way trust relationships can substitute for direct grants. A subject may have no explicit high-privilege role, yet still gain the same result through delegation, pass-through administration or a trusted external account. The governance question is therefore not “was access approved?” but “did the approval create, extend or preserve a path to effective control?”

How to review effective control instead of approved access

The strongest approach is to collapse all contributing relationships into one effective-access view before you certify or recertify anything. That means resolving nested groups, inherited roles, delegated administration, federation links, cross-account trusts and any policy that can amplify the original request. Where the review tooling cannot compute the full path, the control is not complete enough to trust as a sole approval signal.

Use the following checks as the minimum practitioner lens:

• Resolve inherited permissions to the final effective entitlements, not the named role alone.
• Trace delegation chains and trust boundaries to see who can act on behalf of whom.
• Compare approved access with real reachable actions, including admin functions and sensitive resource paths.
• Re-test after directory, group or trust changes, because the effective state can change without a new request.

That approach is easier to operationalise when the organisation has a clear identity control model. NHI Management Group’s Identity Security Programme Guide is useful because it ties governance, RACI and operating model decisions to the authority structure that actually exists. For broader architectural context, the CSA Cloud Controls Matrix is also relevant because it maps IAM and governance controls into cloud assessment and assurance work.

Risk and Threat Considerations

Intent-only review creates a blind spot that attackers can exploit by accumulating privileges through legitimate relationships instead of obvious direct grants. If nested groups, delegated roles or cross-account trusts are not resolved, a benign approval can hide an effective path to sensitive systems, secrets or administrative action.

Failure mechanism: The control fails when the review process validates the request record but does not recompute the post-inheritance authority graph, so amplified access remains invisible.

Impact: Organisations can certify access they would never intentionally approve if they understood the real reach, which increases the chance of privilege creep, separation-of-duties failure and lateral movement through trusted paths.

Practitioner Guidance

What to verify: Confirm that every access review resolves the final effective permissions after inheritance, delegation and group nesting. If the tooling cannot show the complete path from request to action, treat the approval as incomplete evidence rather than a pass.

Decision rule: If a subject can gain administrative or cross-system reach through a parent role, trust relationship or nested group, review the composite path as the control object. Do not let a clean ticket override a dirty authority graph.

What good looks like: Review evidence should show both the approved entitlement and the effective actions it enables, with exceptions called out where hidden amplification exists. The best signal is when governance can explain not just who asked for access, but exactly how the access is realised in production.

Practitioner takeaway: Access governance is only trustworthy when it measures reachable authority. If the review stops at policy intent, it will miss the very inheritance and delegation paths that create most of the real risk.

Related resources from NHI Mgmt Group

• Why do collaboration tools create such a large secrets risk?
• What is the difference between human IAM controls and NHI governance?
• Why do application testing tools matter for NHI governance?
• What does the 144:1 NHI-to-human ratio mean for IAM governance programmes?