Identity is the complex and changing set of features, loyalties, values, roles, and self-descriptions that help define a person or group. In this article, it is treated as something broader than any single record, because identity can shift across time, context, and social setting.
What identity means in security and governance
Identity is not just a login or a profile record. It is the broader, evolving picture of who or what a person, group, or system is understood to be, which means identity can include roles, affiliations, context, history, and how those elements are interpreted in different settings.
That broader view matters in cybersecurity because access decisions, trust relationships, and policy enforcement often depend on identity signals that are partial, contextual, and time-bound rather than fixed.
Why identity shifts across context and time
Identity changes as relationships, responsibilities, and environments change. A person may be an employee, a manager, a contractor, and a member of a professional community at the same time, with each role carrying different expectations and permissions. Group identity can shift as well, because belonging is often defined by shared purpose, social setting, or institutional recognition.
In practice, that means identity is rarely a single stable attribute. Security and governance models that treat identity as static can miss role changes, stale assumptions, and context-specific trust decisions.
Identity as a security and trust signal
In cybersecurity, identity is often used as a basis for authentication, authorization, and accountability, but it should not be confused with those mechanisms. Identity tells you who or what is being represented; authentication tries to prove that claim; authorization decides what the subject may do.
That distinction becomes important when systems rely on federated trust, delegated access, or multiple identity sources. A weak or outdated identity assertion can lead to over-trust, while a well-governed identity model helps reduce confusion between reputation, role, and actual authority. For related identity governance and access-management practice, see the Identity Security Programme Guide.
Identity in organisational and digital environments
Organisations increasingly manage identity across people, devices, services, and software agents, each of which may require different controls and different assumptions about continuity, ownership, and change. A useful identity model has to account for lifecycle events such as joiner, mover, and leaver changes, as well as changes in role, affiliation, and privilege.
That is why identity is usually better treated as a governed relationship than as a fixed record. The same subject can present different identity facets in different systems, and those facets need reconciliation when they affect security, compliance, or operational control.
Risk and Threat Considerations
Identity becomes risky when organisations assume it is stable, singular, or fully trustworthy. Misalignment between a person’s current role and the identity data attached to them can create stale access, incorrect trust decisions, and confusion over who should be accountable for actions.
Failure mechanism: When identity attributes, roles, or affiliations are not updated quickly enough, downstream systems may continue to grant access or trust based on an outdated representation of the subject.
Impact: That can produce excessive privilege, misattribution, access review failures, and a wider blast radius when a compromise or policy exception is tied to the wrong identity state.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST SP 800-53 Rev 5 and NIST CSF 2.0 set the technical controls, while ISO/IEC 27001:2022 defines the regulatory obligations.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev 5 | IA-2 — Identification and Authentication (Organizational Users) | Identity underpins who is authenticated before access is granted. |
| AC-2 — Account Management | Identity changes over time, so account lifecycle control must track role and status changes. | |
| AC-6 — Least Privilege | Identity becomes a trust basis for authorisation, making privilege minimisation essential. | |
| Recommendation — Bind access decisions to verified organizational identities before permitting use of systems. Manage account creation, modification, disabling, and removal as identity context changes. Grant only the access that each identity needs for its current role and task. | ||
| NIST CSF 2.0 | PR.AA-01 — Identity Management, Authentication and Access Control | The term sits at the centre of identity governance and access decisions. |
| Recommendation — Maintain authoritative identity records and enforce access decisions consistently across systems. | ||
| ISO/IEC 27001:2022 | A.5.16 — Identity management | Identity is explicitly governed as a control domain in organisational security management. |
| Recommendation — Define ownership and processes for creating, changing, and retiring identities. | ||
Practitioner Guidance
Why practitioners should care: Treat identity as a governed lifecycle, not a one-time record creation event. The practical question is not only “who is this?” but also “which identity facets are authoritative right now, and for which decision?”
Common misunderstanding: Teams often assume a single directory entry or profile is enough to represent identity everywhere. In reality, different systems may consume different identity claims, so consistency and ownership matter as much as the record itself.
Practitioner takeaway: The most resilient identity models separate enduring personhood from changeable roles, affiliations, and authority, so security decisions can follow the current context rather than a stale label.
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on November 5, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org