Who should be accountable when identity teams expand access governance to unstructured data and SaaS activity insights?

Why This Matters for Security Teams

When identity teams extend access governance into unstructured data and SaaS activity insights, the scope stops being just entitlement administration. It becomes a three-way accountability problem across identity, security, and data ownership. That matters because the same access can look legitimate in one system and dangerous in another, especially when sensitive files, chat exports, and SaaS logs reveal business context that traditional IAM never modeled. NHIMG research on NHI governance shows how quickly visibility gaps become exposure gaps, including the State of Non-Human Identity Security confidence gap that leaves many organisations uncertain about what is actually protected.

Security teams often assume that if an entitlement is approved, the risk is closed. In practice, unstructured data and activity telemetry create a second authorization layer: who may access the data, and what that data reveals when combined with other signals. The governance model must therefore assign decision rights for sensitivity, risk thresholds, and remediation workflow. Frameworks such as the NIST Cybersecurity Framework 2.0 and OWASP Non-Human Identity Top 10 both point toward shared accountability, but current guidance suggests the operating model has to be defined locally. In practice, many security teams encounter this only after a SaaS connector exposes data no one had formally classified.

How It Works in Practice

The most workable model is a three-owner control chain. Identity owns entitlement governance, recertification, and deprovisioning. Security owns monitoring thresholds, anomaly criteria, and escalation rules. Data owners define classification, business purpose, retention, and exceptions. That split is important because unstructured data governance is not purely an access problem; it is also a context problem. A file share, collaboration workspace, or SaaS audit stream may be low risk in isolation but high risk when aggregated, searched, or exported.

In practice, teams should treat access governance for unstructured data as a policy workflow rather than a one-time approval. That usually means:

• Mapping data domains to named business owners who can approve use, not just system access.
• Using identity signals to identify the user or service, but using data labels to determine whether access is appropriate.
• Applying security thresholds to trigger review when activity patterns change, such as mass download, unusual sharing, or dormant account reactivation.
• Documenting who can override an automated denial and under what evidence.

NHIMG’s Ultimate Guide to NHIs — Regulatory and Audit Perspectives reinforces a core operational point: accountability must be auditable, not implied. The same principle appears in NIST control guidance for access enforcement and review, especially NIST SP 800-53 Rev 5 Security and Privacy Controls, where authorization, monitoring, and accountability are distinct control activities. If an organisation is using SaaS activity insights to drive access decisions, the governance process should also define whether the insight is advisory or binding. These controls tend to break down when SaaS telemetry is owned by one team, but the data classification and exception process sit in separate ticket queues.

Common Variations and Edge Cases

Tighter governance often increases operational overhead, so organisations have to balance faster access decisions against stronger review discipline. That tradeoff becomes sharper when unstructured data spans multiple business units or when SaaS activity insights are noisy enough that every anomaly cannot be investigated manually.

There is no universal standard for this yet, but current guidance suggests a few common patterns. For highly sensitive data, the data owner should be the final approver with identity and security providing guardrails. For lower-risk collaboration spaces, identity may own the workflow while data owners predefine policy boundaries. For regulated environments, security may need veto authority when activity indicates possible exfiltration, even if access is formally permitted.

NHIMG breach and exposure research, including the 52 NHI Breaches Analysis, shows why shared accountability matters: weak ownership usually appears first as missed monitoring, not as a clean policy failure. The practical rule is simple. If identity can grant access, data owners must define why access exists, and security must be able to interrupt it when behaviour no longer matches intent.

Related resources from NHI Mgmt Group

• How do automated identity workflows improve SaaS access governance?
• How should security teams migrate identity governance from on premises platforms to cloud based identity security without disrupting access controls?
• Why do identity and access governance projects fail when teams treat them as purely technical initiatives?
• Who should be accountable for non-employee access governance across healthcare onboarding teams?