Between Reviews: A Teardown of Quarterly Governance Failure

This analysis presents a common scenario of identity governance failure, highlighting the risks inherent in periodic reviews. It's a reconstruction of a pattern likely to occur when identity governance isn't continuous. No specific company or incident is referenced.

What Happened

Imagine a team conducting quarterly Certification Campaigns and an annual audit. Both processes pass, but between these reviews, several changes occur: employees switch roles without losing old access, contractors finish projects but retain system access, business units deploy cloud applications without central oversight, service accounts are created for automation, and AI agents are granted access to enterprise data and workflows.

None of these changes trigger immediate reviews, leading to Entitlement Drift. By the next campaign, unnecessary privileges have accumulated, and orphaned accounts have gone unnoticed. The issue isn't a single failed control but the gap between review dates, with non-human identities often falling into this gap.

Timeline

This cycle illustrates a generic pattern, not a specific event.

1. Day of Campaign: Certifications are complete, and access appears clean.
2. Days After: An employee's role changes, but they retain unnecessary access. A contractor's project ends, yet their account remains active.
3. Following Weeks: A business unit launches a cloud application without central oversight. A service account is created for automation. An AI agent gains access to data and workflows.
4. Weeks to Months: Orphaned accounts and excess privileges accumulate without detection, as no review is underway.
5. Next Campaign: Reviewers see only a snapshot. Unmanaged identities remain out of scope.
6. Audit or Incident: When asked who had access on a specific date, the team must manually reconstruct the answer.

Which Controls Failed or Were Missing

• Identity Discovery: Non-human identities and AI agents weren't recorded, making certification impossible.
• Lifecycle Automation: Role changes and contractor offboarding relied on scheduled reviews instead of immediate access updates.
• Continuous Validation: Access was assumed valid until the next campaign, with no interim checks.
• Policy Exception Detection: Toxic Access Combinations and policy violations were only caught if noticed by a reviewer.
• Evidence Generation: Compliance Reporting were compiled after the fact, not generated automatically.
• Business-Unit Onboarding: Cloud applications deployed by individual units weren't integrated into central governance.

The failure was operational, not technical. The model assumed a static enterprise, ignoring the dynamic nature of modern environments.

What the Relevant Standard Requires

While the source doesn't cite specific control numbers, it emphasizes the need for continuous governance. Your control framework should answer these questions on demand:

• Who or what has access right now? Ensure current visibility, not just a past snapshot.
• Why does that access exist? Provide a rationale linked to business needs and policies.
• How is access continuously validated? Show that governance adapts as roles, systems, and risks change.

Map these questions to your framework (NIST, ISO 27001, SOX, etc.), and cite specific requirement numbers from the version your auditors use. A quarterly-tested control can't prove continuous operation. These questions highlight that gap.

Lessons and Action Items for Your Team

Closing this gap requires three capabilities: discover and unify, govern continuously, and demonstrate and respond. Here's how to implement each.

Discover and Unify

• Inventory all identity types: employees, contractors, third parties, service accounts, machine identities, and AI agents. Consolidate them into one system of record.
• Bridge visibility gaps between HR systems, procurement tools, and application teams. Fragmented sources obscure the full scope.
• Assign every non-human identity and AI agent a human owner.

Govern Continuously

• Shift from calendar-driven to event-driven reviews: role changes, contractor end dates, new applications, new service accounts.
• Automate lifecycle management to adjust Birthright Access as business conditions change.
• Adopt Adaptive Identity: dynamically adjust permissions based on business context and risk signals.
• Automate low-risk approvals and escalate anomalies to humans, scaling governance without increasing manual workload.

Demonstrate and Respond

• Ensure evidence is system-generated and available on demand. Avoid manual reconstruction when regulators request point-in-time data.
• Identify policy exceptions before they become audit findings.
• Track the time from governance issue emergence to corrective action. This interval is your true exposure window.

A Self-Test Before Your Next Audit

• Can you identify every identity across your environment?
• Can you show who has access to critical systems at any time?
• Is your access model static or adaptive?
• Can you quickly produce the evidence auditors and regulators need?
• Do you have a unified foundation to adapt to evolving regulations?

If any answer is uncertain, that's your gap. The solution is to make governance an operational discipline that produces evidence as part of daily operations. Platforms like SailPoint Atlas aim to achieve this by managing human, third-party, machine, and AI identities under a single control plane. Whatever tools you choose, ensure your governance operates continuously, not just during reviews.