Who should be accountable for extending access controls across managed and unmanaged work environments?

Why This Matters for Security Teams

Extending access controls across managed and unmanaged work environments is not just an endpoint policy issue. It changes how identity is asserted, how device trust is evaluated, and how applications decide whether a session should be allowed. When the same person uses both corporate-managed laptops and personal devices, the control model has to work without assuming a single device posture or network boundary. That is why identity, security, and platform ownership cannot be separated.

Current guidance suggests aligning this problem to the broader access governance model used in the NIST Cybersecurity Framework 2.0 and the OWASP Non-Human Identity Top 10, because both reinforce that access decisions should be tied to risk, context, and lifecycle control rather than static trust. NHIMG’s Ultimate Guide to NHIs notes that only 5.7% of organisations have full visibility into their service accounts, which is a warning sign for any environment where controls must span multiple device states and policy domains.

In practice, many security teams discover that access control gaps are not caused by a missing policy, but by inconsistent enforcement after a user moves outside the managed estate.

How It Works in Practice

The practical model is shared accountability. IAM owns the authentication and authorisation logic, security defines acceptable risk and assurance thresholds, and operations or platform teams make sure those controls actually function across SaaS, internal apps, VDI, browser access, and mobile workflows. The control stack usually combines conditional access, device posture checks, multifactor authentication, and session policies that can adapt when the device is unmanaged or partially trusted.

For controls to hold up, the organisation needs clear answers to three questions: who is requesting access, what device or session context is present, and what level of assurance is required for this application or data set. That is where policy design matters. NIST SP 800-53 Rev. 5 supports this kind of layered control thinking through access enforcement, monitoring, and least privilege requirements. On the implementation side, NHIMG’s Lifecycle Processes for Managing NHIs reinforces the need for lifecycle visibility and revocation discipline, which becomes even more important when unmanaged endpoints increase the number of places access can be exposed.

• Use policy tiers so managed devices receive broader access than unmanaged ones.
• Require stronger authentication and shorter sessions when device assurance is low.
• Define which apps are blocked, limited, or allowed read-only outside the managed estate.
• Log access decisions centrally so exceptions can be reviewed and tuned.

These controls tend to break down when legacy applications cannot evaluate device context or when business units bypass the standard identity stack to keep access working quickly.

Common Variations and Edge Cases

Tighter access control often increases user friction and support overhead, requiring organisations to balance assurance against productivity. That tradeoff becomes especially visible in BYOD, contractor access, and frontline environments where managed devices are not realistic. In those cases, the answer is not to relax accountability, but to assign it more clearly: security sets the minimum control bar, IAM implements the access logic, and platform teams own the exceptions needed to keep the business running.

There is no universal standard for this yet, but best practice is evolving toward context-aware access rather than one-size-fits-all role design. That means some users get permanent access only on managed endpoints, while unmanaged access is time-bound, scoped, and often read-only. NHIMG’s Key Challenges and Risks is useful here because it highlights how visibility gaps and excessive privilege compound quickly once controls span more than one operating model. For teams looking for a broader risk inventory, the Top 10 NHI Issues page is a practical companion for understanding how identity governance problems surface when access expands faster than oversight.

The main edge case is when unmanaged access is allowed into sensitive systems without per-session assurance checks. In that environment, the policy may exist on paper, but the effective control is too weak to be trusted.

Related resources from NHI Mgmt Group

• How should security teams unify identity controls across human and non-human access in complex enterprise environments?
• Who should be accountable for closing access-trust gaps across BYOD, shadow IT, and unmanaged applications?
• How should organisations extend access governance across complex application environments without losing control of compliance risk?
• Who is accountable when fraud controls fail across registration, deposit, and withdrawal flows?