Access friction creates risk because people respond to delays with shortcuts. When requests take hours or weeks, teams are more likely to use shared logins, over-provision accounts, or leave temporary access in place. Those workarounds weaken auditability, make revocation harder, and expand the number of identities that can reach sensitive systems beyond what is necessary.
Why Friction Becomes a Security Problem, Not Just an Operations Problem
Access management friction changes behaviour. When approved access is slow, inconsistent, or hard to complete, teams optimise for delivery instead of control. The usual result is workarounds: shared credentials, manual exceptions, delayed offboarding, and broad access that persists longer than intended. Those patterns reduce the quality of access decisions and make later review less reliable.
The security issue is not the delay itself, but the pressure it creates on human process. If a team cannot get a legitimate access path quickly, it often chooses the fastest path that still lets work continue. That choice weakens accountability because the environment now contains more identities, more exceptions, and more residual permissions than the control model can comfortably govern.
This is one reason access management has to be treated as a control plane, not a ticket queue. In growing environments, the more systems, teams, and integration points you add, the more friction compounds across onboarding, role changes, contractor access, break-glass use, and service access. The control may look compliant on paper while steadily drifting away from actual use.
How Workarounds Expand Exposure in Fast-Growing Environments
Growth increases the number of decision points where access can be done badly. New applications, mergers, temporary projects, and cross-functional delivery all create more requests and more urgency. If the access process cannot keep pace, teams start borrowing access, reusing accounts, or granting permissions that are wider than the immediate task requires. That directly increases blast radius and makes revocation harder to execute cleanly.
Frustration also degrades governance signals. Shared logins blur attribution, over-provisioning hides excessive privilege inside ordinary business activity, and temporary access often becomes permanent because no one wants to interrupt a working dependency. For readers looking at the NHI side of the same problem, NHIMG’s Ultimate Guide to NHIs and Key Challenges and Risks both show how unmanaged access, over-privilege, and poor visibility compound as environments scale.
The same pattern also appears in incident pathways. Once access is easy to copy, inherit, or leave in place, revocation is no longer a simple administrative task. It becomes a discovery problem, an ownership problem, and often a forensic problem because the original business reason for the access may no longer be obvious.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 address the attack and risk surface, while NIST CSF 2.0, CIS Controls v8 and NIST Zero Trust (SP 800-207) set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST CSF 2.0 | PR.AC — Access Control | Access friction affects how access is granted, reviewed, and removed. |
| Recommendation — Streamline access workflows so approvals and revocations remain enforceable at business speed. | ||
| CIS Controls v8 | 5 — Account Management | Frustrating account processes encourage shared or excessive access. |
| Recommendation — Standardise account provisioning and deprovisioning to reduce shared logins and lingering access. | ||
| NIST Zero Trust (SP 800-207) | 5 — Policy Enforcement | High-friction access often leads to bypasses that weaken policy enforcement. |
| Recommendation — Enforce access decisions at policy points so shortcuts do not bypass control intent. | ||
| OWASP Non-Human Identity Top 10 | NHI-01 — Secrets and Credential Management | Friction often leads to shared credentials, over-privilege, and delayed revocation. |
| Recommendation — Centralise credential handling and make rotation and revocation operationally quick. | ||
Practitioner Guidance
What to prioritise: Focus first on the access requests that people routinely bypass, because those are the best indicators that friction is creating hidden risk. If your teams are using exceptions to move work forward, the process is already telling you where the control model is too slow, too rigid, or too hard to trust.
What to verify: Check whether access can be approved, granted, and revoked within the pace of the work it supports. If revocation lags behind project changes, offboarding, or temporary assignments, the control is not keeping up with the environment even if approvals are technically in place.
Common mistake: Treating every shortcut as user noncompliance instead of a signal that the approved path is failing. If the path is inconvenient enough, people will route around it, and the security team ends up governing the exception instead of the baseline.
Practitioner takeaway: The goal is not zero friction, it is controlled friction. Access should be fast enough to prevent workarounds, but strict enough that every granted path remains attributable, bounded, and removable on the timeline the business actually operates on.
Related resources from NHI Mgmt Group
- Why do non-human identities create audit risk in modern environments?
- When does JIT access create more risk than it reduces?
- Why do distributed sites create more risk for privileged access management than centrally connected environments?
- How should security teams implement human risk management in environments where employees, cloud tools, and AI agents all create exposure?
Deepen Your Knowledge
Reviewed and updated by the NHIMG editorial team on September 20, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org
