Every identity decision is only as good as the data behind it. Joiner-mover-leaver automation depends on accurate HR records, access reviews depend on knowing who owns what, attribute-based access depends on correct attributes, and identity threat detection depends on linking accounts to the right person or workload. In most organisations identity data is spread across HR systems, directories, identity providers, applications, cloud platforms and spreadsheets, with gaps and contradictions between them. This guide explains authoritative sources, correlation, attribute quality and what an identity fabric means in practice, for human and non-human identities.
Key takeaways
- Define an authoritative source for every attribute, not just every identity.
- Correlation, linking accounts across systems to a person or workload, is the core problem. Measure how accurate it is.
- Non-human identities rarely have an HR record. They need an owner and purpose captured at creation.
- An identity fabric is an architecture that connects identity services and data, not a single product.
- Treat identity data quality as an ongoing process with owners and metrics.
Why identity data goes wrong
- Late or missing HR updates: leavers processed after their last day, movers never recorded, contractors missing from HR.
- Multiple sources disagreeing: different names, departments or managers in HR, the directory and applications.
- Accounts with no link to a person: local application accounts, shared accounts and legacy admin accounts.
- NHIs with no record at all: service accounts, API keys and OAuth apps created outside any process. See the NHI Ownership Guide.
- Stale attributes: roles, cost centres and locations that were right once.
- Mergers and acquisitions: duplicate identities across combined directories.
Authoritative sources
| Identity or attribute | Typical authoritative source |
|---|---|
| Employees: existence, start and end dates, manager, department | HR system |
| Contractors and third parties | Vendor management system or a sponsored-identity process. See the Third-Party Access Guide |
| Contact details, device assignment | Directory or IT service management |
| Entitlements | The target application or cloud platform (the only reliable source of what access actually exists) |
| Workloads and service accounts | Cloud platforms, Kubernetes, CI/CD and a registry that records owner and purpose |
| AI agents | An agent registry. See the Agentic AI Identity Guide |
| Customers | The CIAM platform and the proofing record |
Document the source for each attribute, the flow into downstream systems and what happens when sources conflict.
Correlation
- Link accounts to identities using stable identifiers (such as an employee number) rather than names or email addresses, which change.
- Use rules and, where helpful, similarity matching, but keep a human review queue for uncertain matches.
- Track correlation coverage: the share of accounts in each system linked to a known person or workload.
- Flag accounts that correlate to nobody as orphaned and route them to review. See the Access Reviews Guide.
- Resolve effective access, including nested groups and inherited cloud permissions, so the data reflects what an identity can really do. See the IVIP Guide.
Attribute quality
- Choose a small set of attributes that access decisions actually use, and make those excellent.
- Validate on entry: required fields, allowed values and consistency checks.
- Assign an owner to each critical attribute and measure completeness, accuracy and timeliness.
- Watch attribute changes as security events: a department or manager change can grant or remove access. See the Joiner-Mover-Leaver Guide.
What an identity fabric is
Industry analysts use "identity fabric" to describe an architecture where identity services, such as authentication, authorisation, governance, privileged access and identity threat detection, share common identity data and signals across a hybrid estate, instead of operating as disconnected silos. In practice it means:
- A shared, correlated view of identities and access (often called an identity graph).
- Standard integration patterns: SCIM for provisioning, OpenID Connect and SAML for federation, shared signals for events. See the SCIM Provisioning Guide.
- Policy that can be applied consistently across platforms.
- Coverage of human, non-human and AI agent identities together. See the Identity Convergence Guide.
No single product delivers this; it is built by integrating the tools you have around good data.
Identity data for AI-driven decisions
Identity tools increasingly use analytics and AI to recommend access, flag outliers and summarise risk. Those recommendations are only as reliable as the underlying data: an AI that learns from incorrect roles will recommend incorrect access with confidence. Fix data quality before relying on automated recommendations, and keep explanations visible to reviewers.
Measuring identity data quality
- Percentage of accounts correlated to a known identity, per system.
- Percentage of NHIs with owner and purpose recorded.
- Time from HR event to access change.
- Completeness and accuracy of critical attributes, sampled regularly.
- Number of orphaned and duplicate identities.
Practitioner checklist
- Name an authoritative source for each identity type and each attribute that drives access.
- Correlate accounts using stable identifiers and measure coverage per system.
- Capture owner and purpose for every NHI and AI agent at creation.
- Validate critical attributes on entry and assign owners to them.
- Resolve effective access across nested and inherited permissions.
- Treat attribute changes as access-relevant events.
- Report identity data quality metrics alongside identity risk metrics.
Standards and references
- ISO/IEC 24760-1: A framework for identity management
- RFC 7643: SCIM Core Schema
- OpenID Shared Signals Working Group
- NIST SP 800-53 Rev. 5 (AC-2 Account Management)
Related NHI Mgmt Group resources: IVIP Guide · Identity Convergence Guide · Joiner-Mover-Leaver Guide · IAM and IGA Basics
