Directory trust fabric

Expanded Definition

Directory trust fabric is the operational web of authentication, authorization, delegation, and privilege relationships that a directory uses to decide what an identity can access. It is broader than a password store or account list because it includes group nesting, service account entitlements, admin delegation paths, token issuance dependencies, and the trust assumptions embedded in directory-linked applications.

In NHI governance, this matters because human users and non-human identities often draw authority from the same directory state. When that state is inconsistent, stale, or over-permissive, the blast radius extends across both populations. This is why NHI Management Group treats directory trust fabric as a Zero Trust concern, not just an IAM administration concern, and why it aligns with guidance such as the NIST Cybersecurity Framework 2.0. Definitions vary across vendors on whether trust fabric includes only identity plane controls or also adjacent policy engines, but the practical boundary is simple: if a directory decision can grant access, it is part of the fabric.

The most common misapplication is treating directory trust fabric as a static architecture diagram, which occurs when teams ignore inheritance, delegated admin paths, and service-account permissions that continue to change after deployment.

Examples and Use Cases

Implementing directory trust fabric rigorously often introduces administrative overhead, requiring organisations to balance tighter control over access paths against the operational cost of continuous review.

• Group nesting grants a service account access to production systems because the account inherits membership through multiple nested roles.
• A delegated administrator can reset credentials for both human users and NHI accounts, creating an escalation path if the delegation scope is too broad.
• An application trusts directory-issued tokens for API calls, so a directory misconfiguration immediately affects machine-to-machine access.
• Legacy accounts remain linked to privileged groups long after the owning team changes, creating hidden trust relationships that auditors miss.
• Directory state and secrets handling intersect when credentials are stored outside a secrets manager; the Ultimate Guide to NHIs notes that 96% of organisations store secrets in vulnerable locations, which often amplifies directory misuse.

In practice, this term is especially relevant during identity migration, cloud directory federation, and incident response. The NIST Cybersecurity Framework 2.0 reinforces the need to identify and protect identity dependencies, while NHIMG guidance shows why hidden service-account sprawl and over-privilege make those dependencies harder to see.

Why It Matters in NHI Security

Directory trust fabric is where NHI risk becomes systemic. If service accounts, API keys, and workload identities inherit excessive privilege from the directory, attackers do not need to break every control individually. They can compromise one trusted relationship and move laterally through access paths that were never intended for machine identities. That is why directory hardening is inseparable from NHI governance, offboarding, and privilege review.

NHIMG research shows that 97% of NHIs carry excessive privileges and only 5.7% of organisations have full visibility into their service accounts, which means most directory fabrics contain unseen trust paths that can outlive their intended purpose. Those conditions make access reviews, key rotation, and delegated administration controls critical, especially when directory changes affect automation pipelines, cloud access, or privileged tooling. The practical lesson is that a directory can be “working” while still being unsafe.

Organisations typically encounter the consequences only after an account takeover, privilege escalation, or major secrets leak, at which point directory trust fabric becomes operationally unavoidable to address.

Related resources from NHI Mgmt Group

• Why do Active Directory service accounts complicate zero trust programs?
• Trust Directory
• Trust Fabric
• Directory trust mapping