New Enemy Problem

Expanded Definition

The new enemy problem describes a change in authorization truth after an earlier access decision was made. A user or role that was acceptable at one point may become unsafe when the protected resource, surrounding data, or policy context changes, even though the original permission record has not changed.

This matters in systems that cache authorization decisions, rely on long-lived entitlements, or separate identity checks from content-sensitive controls. The term is often discussed alongside Zanzibar-style policy evaluation and other distributed authorization models, but the core issue is broader: an access decision can become stale when the thing being protected changes. In practice, the boundary is easy to miss because the identity looks the same while the risk posture has changed.

The concept is not about authentication failure. It is about authorization drift, where a previously valid yes answer is no longer safe to reuse. For NHI-heavy environments, the same pattern appears when service accounts, tokens, or delegated agents keep access after the underlying resource becomes more sensitive.

Examples and Use Cases

Common situations where the new enemy problem appears include:

• A document was public when a cached policy decision was made, but later receives confidential data and still inherits the older allow result.
• A workflow engine keeps using a prior entitlement snapshot even after a file, dataset, or project crosses into a higher sensitivity tier.
• An API gateway trusts a token-based approval that was valid before a scope or data classification change, so the old decision outlives the new context.
• An AI agent or automation service retains access to a resource after the resource owner changes the workflow purpose or handling rules.
• A distributed authorization layer returns a fast cached answer for performance, but the cached response no longer reflects the current object state.

The trade-off is usually speed versus freshness. Stronger freshness checks reduce the chance of stale decisions, but they can increase latency and make large-scale authorization harder to operate consistently. The OWASP Non-Human Identity Top 10 is useful context when this pattern affects machine credentials, service accounts, or agent access paths.

Security Implications

The main security failure is overtrust in an answer that was correct only for an earlier state. That creates a window where access appears legitimate even though the resource has changed in a way that should alter the decision. The consequence can be unauthorized disclosure, inappropriate write access, or policy bypass that is hard to detect because the identity itself did not obviously misbehave.

In NHI environments, this is especially problematic because non-human access is often persistent, automated, and widely reused. NHIMG research shows that 97% of NHIs carry excessive privileges, which amplifies the damage when a stale allow decision persists after a resource becomes more sensitive. A common practitioner observation is that incidents rarely begin with a dramatic policy failure; they begin with a quiet mismatch between cached authorization and current object state.

The blast radius grows when the same decision path serves many identities, tenants, or workloads. If the authorization layer cannot quickly invalidate prior assumptions, stale permissions can spread across multiple systems before anyone notices the protected asset has effectively become a new target.

Domain and Governance Relevance

The new enemy problem matters most in authorization design, identity governance, and state-sensitive access control. It is a reminder that access is not only a property of the subject, but also of the object and its current context. For security teams, that means governance has to account for change events that alter sensitivity, purpose, or policy inheritance.

In NHI governance, the issue is sharper because service accounts, API keys, and agents often operate without human review at the moment of use. If the resource changes after the last approved access, the system needs a way to reassess whether that non-human identity still belongs there. NHIMG’s Ultimate Guide to NHIs is a practical reference for the lifecycle controls that reduce this kind of stale trust.

For practitioners, the governance question is not whether access was once valid. It is whether the authorization model can detect that the resource has changed enough to invalidate the prior answer.

Related resources from NHI Mgmt Group

• Why do deepfakes create a new identity security problem even when passwordless is deployed?
• Why do MCP servers create a new authorization problem for IAM teams?
• Why do AI assistants create a new trust problem for identity governance?
• Why do agentic workflows create a new identity governance problem?