When pricing moves away from per-user licences, licence optimisation stops being a meaningful security proxy. The programme has to focus on whether identities can be issued, reviewed, and revoked correctly across human, non-human, and agentic actors. Security value shifts from saving seats to controlling access scope.
When pricing stops being the control point, what becomes the governance point?
Usage-based SaaS pricing changes the operating assumption behind identity governance. In a per-user world, licence counts often acted as a rough proxy for account hygiene, because dormant or duplicate accounts had a visible cost. Once billing tracks consumption instead, governance has to answer a different question: which identities are allowed to exist, what can they reach, and who is accountable for their lifecycle.
This is why identity work shifts from seat management toward access governance. The programme must track whether the organisation can still discover, classify, and own every actor that can consume the service, including human users, service identities, and software-driven actors. That expands the scope of joiner, mover, and leaver control, because access now matters even where a named user licence no longer exists.
A useful way to think about the change is that usage pricing removes a financial signal, but it does not remove the security obligation. If anything, it makes hidden access more dangerous because a low-cost or unmetered identity can still reach sensitive data, automate actions, or create downstream trust relationships. Governance therefore needs stronger inventory, clearer ownership, and tighter review of effective access than a licence ledger could ever provide.
Why human-only licence logic breaks down across machines and agents
Usage-based pricing makes it harder to treat identity governance as a human-user exercise. Many SaaS deployments now include API clients, integration accounts, background jobs, bots, and AI agents that consume capabilities at runtime. A policy built only around named seats will miss those actors, even though they may hold privileged tokens, call sensitive APIs, or operate on behalf of people.
That is where the control question changes from “Is this person paying for a seat?” to “Can this actor be issued access, can that access be reviewed, and can it be revoked quickly when the business need ends?” NHIMG’s IAM and IGA Basics is a useful foundation for that shift because it separates authentication, authorization, provisioning, and review, which are the mechanics that usage-based pricing tends to obscure.
For non-human and agentic access, lifecycle discipline becomes the real control surface. NHI lifecycle management is especially relevant because the hardest failures are usually not about cost, but about stale credentials, orphaned integrations, and privileges that outlive the business process they were created for.
When service identities or agents are in scope, the review model should be based on function, ownership, and blast radius, not headcount. A workflow that only reconciles employee seats will not tell you whether a token can still write to production, impersonate a user, or trigger an external workflow after the business owner has changed.
What governance should measure instead of licence optimisation
Once pricing is usage-based, the best governance metrics are effective-access metrics. That means counting who and what can reach the service, which entitlements are active, how quickly excess access is removed, and whether each identity has a clear owner and expiry condition. Licence utilisation becomes a finance metric, not a security control.
Access review quality also matters more than review volume. Access Reviews and Certification Guide is relevant because usage-based pricing often increases the number of low-visibility accounts, shared integration paths, and service identities that need focused review rather than broad rubber-stamping. The goal is to review the access that can actually cause harm, not the access that merely affects the invoice.
Role design needs the same adjustment. If the organisation is trying to control access across humans, services, and agents, then role sprawl becomes a governance issue long before it becomes a billing issue. Role Mining and Role Design Guide helps here because roles should express stable business function, not payment model convenience. Where the service model is dynamic, roles should be bounded tightly enough that access can be revoked without breaking unrelated workflows.
At scale, the most important signal is whether the organisation can answer three questions quickly: who owns the identity, what it can do, and how it is removed. If those answers require chasing procurement records or application teams, the governance model is lagging behind the pricing model.
Risk and Threat Considerations
Usage-based pricing can hide excessive access because an identity no longer stands out as a paid cost centre. That creates risk when dormant service accounts, overprivileged integrations, or agent credentials remain active after business use has faded, especially if they can reach production data or automate transactions.
Failure mechanism: security teams lose the licence-based pressure to find and remove unused access, so stale identities, broad entitlements, and unmanaged tokens persist longer and create larger blast radius when compromised or misused.
Impact: attackers, careless automation, or simply forgotten integrations can use those lingering paths to access data, trigger actions, or move laterally through connected SaaS workflows without being obvious in a seat-count review.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST SP 800-53 Rev 5 and NIST CSF 2.0 set the technical controls, while ISO/IEC 27001:2022 defines the regulatory obligations.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev 5 | IA-5 — Authenticator Management | Covers lifecycle control over credentials and tokens that usage-based SaaS still relies on. |
| AC-2 — Account Management | Directly governs account provisioning, review, and removal across human and non-human actors. | |
| AC-6 — Least Privilege | Usage-based pricing can hide overreach; least privilege limits what active identities can do. | |
| Recommendation — Manage credential issuance, rotation, and revocation for all SaaS identities. Maintain current account inventories and remove unnecessary SaaS access promptly. Restrict SaaS entitlements to the minimum access needed for each identity. | ||
| ISO/IEC 27001:2022 | A.5.15 — Access control | Access control remains central when licence cost stops reflecting actual access risk. |
| A.5.16 — Identity management | Identity management must cover humans, service accounts, and agents whose access no longer maps to seats. | |
| A.5.18 — Access rights | Tracks review and removal of access rights, which becomes more important when pricing is not seat-based. | |
| Recommendation — Define and enforce access rules based on business need, not licence model. Inventory and govern all identities that can access the SaaS platform. Review and revoke stale SaaS access rights on a defined schedule. | ||
| NIST CSF 2.0 | ID.AM-01 — Physical devices and systems are inventoried | Identity governance depends on knowing what assets and connected actors exist across the SaaS estate. |
| PR.AA-01 — Identities and credentials are issued, managed, verified, revoked, and audited | Directly matches the change from licence optimisation to lifecycle control of all identities. | |
| GV.RM-01 — Risk management strategy | Supports the governance shift from cost-centred licence management to access-risk management. | |
| Recommendation — Inventory systems and connected actors that can consume the SaaS service. Issue, review, revoke, and audit SaaS identities and credentials continuously. Align SaaS governance metrics to access risk and business impact. | ||
Practitioner Guidance
What to prioritise: treat identity inventory and ownership as the primary control, then separate human, service, and agent access into distinct review paths. If a platform can be consumed without a seat, it still needs expiry, ownership, and revocation discipline.
What to verify: check whether every non-human identity has a named owner, a documented purpose, and a revocation trigger. If the team cannot demonstrate that for integrations and agents, the governance model is still anchored to procurement rather than access control.
Common mistake: keeping licence optimisation dashboards while assuming they indicate security health. In usage-based environments, low spend does not mean low risk, and a cheap token can be more dangerous than an expensive user seat.
Practitioner takeaway: usage-based pricing changes the question from “how many seats are we paying for?” to “which identities can still act, for how long, and under whose accountability?”
Related resources from NHI Mgmt Group
- Why is it important to integrate identity and data governance?
- What is the difference between role-based access and API key governance for NHI security?
- How can organisations decide whether to move from seat-based to usage-based identity pricing?
- How do machine-majority environments change identity governance priorities?
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 7, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org