A connector that extracts data from a source system without changing it. For identity governance, read-only mode is the safest way to centralise access information first, then decide later whether controlled provisioning or revocation should be enabled.
What a read-only connector does
A read-only connector pulls data out of a source system without writing back to it, which makes it useful when the first goal is discovery, inventory, or validation rather than automated change. In identity governance, that distinction matters because you can centralise visibility into accounts, roles, and entitlements before any provisioning or revocation workflow is allowed to touch the source.
Why read-only mode is the safest starting point
Read-only mode reduces the chance that an integration accidentally changes production data, triggers workflow side effects, or creates drift between systems. It is especially valuable when the source system is fragile, heavily governed, or owned by another team, because the connector can observe state without becoming part of the change path.
That safety is not just operational convenience. A read-only connector also helps establish trust in the data itself, because teams can compare what the connector returns with source-system records, downstream reports, and access reviews before they automate anything that would alter accounts or privileges.
When a connector is used only for extraction, the main design question becomes whether the data is complete, current, and correctly scoped, not whether the connector has enough authority to modify records.
Common failure modes and design limits
A read-only connector can still create governance problems if it is configured too broadly, misses important objects, or silently fails to retrieve fields needed for review. In practice, the risk is often incomplete visibility, not unintended change, because a partial inventory can look authoritative even when it excludes service accounts, inherited entitlements, or locally managed exceptions.
The connector can also become stale if the source schema changes, API permissions drift, or the integration cannot handle rate limits and pagination correctly. In those cases, read-only mode protects the source system, but it does not guarantee that the governance view remains accurate enough to support decisions.
Where read-only connectors fit in identity governance
For identity programmes, a read-only connector is usually the first phase of onboarding a system into governance. It lets teams discover identities, entitlements, and access relationships, then decide whether the business case justifies controlled provisioning, deprovisioning, or certification later.
This sequencing is important because change authority should follow understanding. A connector that can only extract data supports review, reconciliation, and exception analysis without giving the governance platform immediate power to alter accounts or entitlements in a source system.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST SP 800-53 Rev 5 and NIST CSF 2.0 set the technical controls, while ISO/IEC 27001:2022 defines the regulatory obligations.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev 5 | AC-2 — Account Management | Read-only connectors support account inventory and governance before provisioning or revocation decisions. |
| IA-5 — Authenticator Management | Connectors that read governance data still rely on controlled credentials and rotation discipline. | |
| AU-6 — Audit Record Review, Analysis, and Reporting | Read-only extraction feeds review and reconciliation workflows that depend on trustworthy audit data. | |
| Recommendation — Use AC-2 to inventory accounts before granting any connector write capability. Apply IA-5 to manage the connector's credentials and rotate them on a defined lifecycle. Use AU-6 to review connector-collected records for completeness and anomalies. | ||
| NIST CSF 2.0 | ID.AM-01 — Physical Devices and Systems Inventory | A read-only connector helps build an accurate inventory of connected systems and governance data. |
| PR.AA-01 — Identities and Credentials Are Issued, Managed, Verified, Revoked, and Audited | Identity governance connectors support managed visibility into identity state before access changes are allowed. | |
| Recommendation — Use ID.AM-01 to maintain an accurate inventory of systems the connector can observe. Use PR.AA-01 to keep identity records governed before any automated writeback is enabled. | ||
| ISO/IEC 27001:2022 | A.5.9 — Inventory of information and other associated assets | Read-only connectors support asset and identity visibility by extracting records without modifying the source. |
| Recommendation — Maintain an accurate asset inventory before enabling any connector to change source records. | ||
Practitioner Guidance
Governance implication: Treat read-only connectors as onboarding and assurance controls first, not as a default precursor to write access. If the data they return will drive access decisions, make ownership, scope, and refresh expectations explicit before any provisioning path is enabled.
What to watch for: Validate that the connector returns the objects and attributes your reviewers actually need, including edge cases such as dormant accounts, delegated access, and non-standard roles. If the source system changes, recheck whether the connector is still faithfully representing what exists.
Related resources from NHI Mgmt Group
- What is the difference between a read only MCP connector and a traditional security integration that can change records?
- Should organisations use connector-less deployment for on-prem DSPM where possible?
- Why do read-only AI agents still create serious security risk?
- What do security teams get wrong about connector credentials in infrastructure automation?
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 30, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org