Identity Governance

IGA is the set of processes and tools for managing who has access to what, and proving that access is appropriate. It includes provisioning and deprovisioning, access requests, access reviews, policy enforcement, and compliance reporting across human and non-human identities.

An access review, or certification, is a periodic check where managers or resource owners confirm whether each identity still needs its access. Many organizations run reviews quarterly for sensitive systems and annually for others, though continuous, risk-based reviews are increasingly replacing fixed schedules.

The identity lifecycle covers every stage of an identity’s existence: joining, moving between roles, and leaving (often referred to as JML). Governance ensures access is granted correctly at the start, adjusted when responsibilities change, and fully removed at the end, preventing orphaned accounts and privilege creep, as well as their exploitation.

Regulations and frameworks such as SOX, HIPAA, GDPR, and SOC 2 require organizations to control and evidence access to sensitive data. IGA provides the policies, approval records, review history, and audit trails needed to demonstrate that access is authorized and regularly validated.

Apply the same principles used for people: assign every non-human identity an accountable owner, define its purpose, scope its permissions, include it in access reviews, and retire it when no longer needed. AI agents in particular should be governed as first-class identities alongside the human workforce. Unlike other non-human identities, AI agents can take more independent action and impact more systems, which makes their need for governance and accountability distinct.