Why do standing access and fragmented governance create SoD risk in modern identity programmes?

Why This Matters for Security Teams

Standing access is convenient until it becomes invisible risk. In identity programmes, segregation of duties fails when entitlements are granted once and then left in place while people, applications, and approval chains change around them. Fragmented governance makes that worse because no single control owner can reliably see incompatible access across HR, IAM, PAM, SaaS, and cloud systems. The result is delayed detection, not deliberate approval.

This is especially dangerous where non-human identities are mixed into the same approval process as people. NHIMG’s Ultimate Guide to NHIs notes that 97% of NHIs carry excessive privileges, which is a strong signal that static access models routinely overshoot actual need. When governance is fragmented, those excesses are harder to spot because review evidence is spread across tools instead of enforced as one policy. Current guidance from NIST Cybersecurity Framework 2.0 and the OWASP Non-Human Identity Top 10 both point toward continuous, risk-aware governance rather than periodic trust-by-default reviews. In practice, many security teams discover SoD conflicts only after an audit or incident has already exposed the control gap.

How It Works in Practice

SoD risk grows when access decisions are separated from the context that should constrain them. A user may hold procurement approval in one system, payment release in another, and emergency admin in a third. None of those entitlements looks dangerous on its own, but together they create a path for fraud, abuse, or accidental override. The same pattern applies to agentic and automated workloads, where standing credentials can be chained into tool access, lateral movement, and privilege escalation.

Practitioner guidance is moving toward policy-based review and runtime authorisation. That means access is evaluated at the moment of use, not only during quarterly certification. For NHIs and agents, best practice is evolving toward ephemeral credentials, short TTL secrets, and workload identity that proves what the entity is, rather than trusting a long-lived shared token. Controls such as JIT access, PAM, and Zero Trust are most effective when they are enforced through a single policy layer instead of scattered team-by-team exceptions.

• Define incompatible duties as machine-readable policy, not spreadsheet logic.
• Bind approvals to the transaction, workflow, or task context that triggered them.
• Use short-lived credentials and automatic revocation after task completion.
• Correlate identity data across IAM, PAM, SaaS, cloud, and secrets platforms.
• Review both human and non-human access in the same control plane where possible.

NHIMG’s Ultimate Guide to NHIs — Regulatory and Audit Perspectives highlights the governance burden when evidence is split across systems, while NIST control guidance in NIST SP 800-53 Rev 5 Security and Privacy Controls supports least privilege and separation duties as core requirements. These controls tend to break down when approval data is siloed across legacy IAM, SaaS admin consoles, and manually maintained exception registers because no single system can validate the full duty chain.

Common Variations and Edge Cases

Tighter SoD enforcement often increases operational friction, requiring organisations to balance control assurance against workflow speed. That tradeoff becomes more visible in agile delivery, emergency operations, and hybrid human-plus-agent processes, where rigid approvals can slow legitimate work. The current guidance suggests allowing narrowly scoped exceptions, but only when they are time-bound, auditable, and automatically removed after use.

There is no universal standard for how to measure cross-platform SoD in environments with heavy SaaS sprawl or autonomous agents. Some teams can enforce policy centrally; others need compensating controls such as immutable logging, dual approval for high-risk actions, and periodic entitlement recertification. For modern identity programmes, the key question is not whether access was once approved, but whether it is still appropriate across all systems that can act on it. NHIMG’s Ultimate Guide to NHIs — Lifecycle Processes for Managing NHIs is useful here because lifecycle ownership is where many SoD issues are either prevented or left to drift. In fragmented environments, SoD controls degrade fastest when ownership changes but entitlements and review rules do not.

Related resources from NHI Mgmt Group

• Why do standing privileges and stale access create hidden identity risk even when authentication looks strong?
• Why do standing credentials create so much risk in modern identity programmes?
• Why do cloud ERP environments still create identity and access risk even when workflow automation is in place?
• How should organisations use identity security events to improve access governance programmes?