What is the difference between configurable governance and custom-code identity automation?

Why This Matters for Security Teams

Configurable governance and custom-code automation can look similar on paper, but they fail in different ways. Native policy controls make it easier to assign ownership, review changes, and survive platform upgrades. Bespoke code can encode business nuance, yet it often spreads identity logic across scripts, pipelines, and tickets where no single team can explain the full control path. That matters because NHI risk is usually operational, not theoretical.

NHI Management Group research shows why this distinction matters: 30.9% of organisations store long-term credentials directly in code, and 96% store secrets outside secrets managers in exposed locations such as code, config files, and CI/CD tools. That pattern is hard to govern when the control itself lives in custom automation. Current guidance from NIST Cybersecurity Framework 2.0 and the NHIMG Ultimate Guide to NHIs points toward auditable, policy-driven identity operations rather than hidden logic paths.

In practice, many security teams discover their automation is unreviewable only after a failed rotation, an access review exception, or a production incident exposes how much trust was placed in undocumented code.

How It Works in Practice

Configurable governance expresses identity policy through the platform’s native features: role assignment, approval workflows, lifecycle rules, expiry settings, and built-in integrations. The key advantage is that the control plane remains visible to auditors and operators. Changes are usually versioned as configuration, tied to named owners, and easier to assess during upgrade cycles. For NHIs, that means access decisions, credential rotation, and offboarding can be managed as governed workflows rather than hidden logic.

Custom-code identity automation uses scripts, functions, or event handlers to do the same work. It may call APIs to create service accounts, issue secrets, sync entitlements, or enforce bespoke approval logic. That flexibility helps when a platform lacks a native control, but it also creates a second system of record. The more the automation depends on exception handling, branching logic, and environment-specific assumptions, the more likely it is to drift from policy.

• Use configurable governance when the action is standard and repeatable, such as rotating a secret on a fixed schedule.
• Use custom code only when the workflow cannot be expressed safely in native controls, and document the policy boundary.
• Keep identity logic declarative where possible, so reviewers can see what should happen without tracing execution flow.
• Test upgrade resilience, because native controls usually survive platform changes better than bespoke scripts.

For implementation, NIST SP 800-53 Rev. 5 gives a useful control baseline for access, auditability, and configuration management, while the NHIMG Lifecycle Processes for Managing NHIs section frames the operational steps from provisioning to revocation. These controls tend to break down in highly distributed environments where every application team maintains its own scripts and no central policy owner can verify what the automation actually enforces.

Common Variations and Edge Cases

Tighter native governance often increases upfront process overhead, so organisations must balance speed of delivery against long-term auditability. Best practice is evolving, and there is no universal standard for how much identity logic should remain configurable versus coded.

Some edge cases justify custom code: legacy systems without modern workflow support, complex cross-system approvals, or integrations that require event-driven orchestration. Even then, the safer pattern is to keep the policy decision in a configurable layer and let code handle only the mechanics. That reduces the chance that business rules become trapped in a script that only one engineer understands.

Teams should also be careful not to equate “configurable” with “safe by default.” Poorly designed settings can still create over-permissioning, weak exception handling, or silent drift. The NHIMG Top 10 NHI Issues research and 52 NHI Breaches Analysis both reinforce the same operational lesson: visibility and revocation discipline matter as much as the implementation style. Custom-code automation becomes especially risky when it is used to manage secrets, because a small logic error can leave credentials active long after the change was intended.

Related resources from NHI Mgmt Group

• What is the difference between attack surface management and NHI governance?
• What is the difference between role-based access and API key governance for NHI security?
• What is the difference between human IAM controls and NHI governance?
• What is the difference between patching a vulnerability and reducing identity blast radius?