Who is accountable when device posture and access policy drift out of sync?

Why This Matters for Security Teams

device posture drift becomes an accountability problem because access decisions are only as reliable as the policy inputs behind them. When endpoint health checks, identity rules, and revocation timing do not line up, users or NHIs can retain access after the device no longer meets the intended trust standard. That gap is exactly why zero trust programs emphasise continuous verification in the NIST Cybersecurity Framework 2.0.

For NHI and agentic environments, the issue is sharper: a workload or agent may keep operating with stale trust signals even after its host posture changes. NHIMG’s Lifecycle Processes for Managing NHIs show that governance only works when ownership, evaluation cadence, and offboarding are explicit. The practical question is not whether posture is checked, but who is accountable when the check and the policy disagree.

In practice, many security teams discover this mismatch only after access has already been abused, rather than through intentional policy testing.

How It Works in Practice

Accountability should follow control ownership. Identity teams usually own the policy logic, endpoint or device teams own the posture signals, and platform teams own the enforcement path. Security operations can detect drift, but they rarely control the underlying rules. In a mature setup, the policy states what a compliant device looks like, the posture engine supplies current evidence, and the access broker denies or revokes access when the evidence no longer matches.

That model works best when evaluation is continuous and machine-readable. The organisation should define which posture signals matter, how much staleness is acceptable, and whether access is blocked immediately or stepped down to a lower-risk mode. This is where the principles behind OWASP Non-Human Identity Top 10 and NIST control thinking intersect: if secrets, tokens, or sessions outlive the posture check, then the identity layer is effectively trusting an outdated device state.

For NHI-heavy estates, this should include service accounts, API keys, CI/CD runners, and agent workloads that authenticate from managed devices or ephemeral execution hosts. NHIMG’s Top 10 NHI Issues highlights how weak lifecycle control and excessive standing access turn small drift events into broad exposure. A common operating pattern is:

• endpoint telemetry updates the posture verdict
• the policy engine compares that verdict to required conditions
• the IAM or access proxy enforces allow, step-up, quarantine, or revoke
• audit owners confirm which team owns each rule and each signal

These controls tend to break down when devices are offline, posture reports are delayed, or the access path bypasses the normal enforcement point because stale state then survives longer than the policy intended.

Common Variations and Edge Cases

Tighter posture enforcement often increases operational friction, requiring organisations to balance stronger assurance against user disruption and support load. That tradeoff is especially visible in remote work, contractor access, and OT or regulated environments where endpoints cannot always meet the same baseline. There is no universal standard for this yet, so current guidance suggests documenting compensating controls rather than pretending one posture model fits every device class.

One common edge case is split responsibility across endpoint security, IAM, and application owners. If no single team owns the deny decision, drift becomes a blame-shifting exercise instead of a control failure that gets fixed. Another edge case is service-to-service access, where posture may reflect a container image, node attestation, or workload runtime rather than a laptop. In those cases, the access policy should be tied to workload identity and runtime integrity, not just device compliance.

NHIMG’s Ultimate Guide to NHIs is useful here because it frames identity governance as lifecycle control, not a one-time approval. For breach context, the 52 NHI Breaches Analysis reinforces a consistent pattern: when access remains valid after trust conditions change, attackers inherit the gap.

When posture and access are tightly coupled, accountability is clear on paper. In practice, it usually fails at the seams between teams, where nobody owns the last mile of revocation.

Related resources from NHI Mgmt Group

• Who is accountable when SAP HANA access rules drift away from business policy?
• Who is accountable when physical access decisions do not match HR status or security policy?
• Who is accountable when identity drift or excessive access affects regulated aviation operations?
• Who is accountable when certificate-based device identity fails in a managed access model?