Identity governance creates gaps when activities run without producing authority control. Governance workflows that execute — access reviews complete, attestations submit, reports generate — can document compliance activity while leaving permissions unchanged. The operational consequence: extensive governance overhead with persistent overprivilege and dormant accounts. What changes the outcome: distinguishing between governance activity (process completion) and governance control (authority modification with verified enforcement).
Conceptual model
Identity governance controls four things: authority assignment decisions, ownership accountability, review effectiveness, and revocation enforcement. Each control operates on authority — the permissions an identity can exercise — not the administrative records that track those permissions.Authority assignment governs which identities receive which permissions, under what justification, with named approver accountability. Provisioning workflows that execute without auditable approval decisions are access automation, not governance. The governance event is the accountable decision, not the technical provisioning action.
Ownership assigns accountability for each authority grant remaining justified. Ownership differs from initial approval — it identifies who can verify current authority and justify its continuation. Ownership without the ability to verify current authority (what the identity can actually do across connected systems) creates nominal accountability without functional control.Review effectiveness validates that authority remains justified through periodic verification by decision-makers with authority visibility. A review produces evidence of a decision (confirmed with justification or revoked) and, for revocations, evidence of permission removal in connected systems. A review outcome in which every grant is confirmed appropriate is a valid result — it means access is current and accountable. A near-zero revocation rate can be a warning sign that the review process is not surfacing unjustified authority, but it is not automatically an indicator of failure. Where controls are functioning correctly upstream — through accurate provisioning and timely lifecycle updates — low revocation rates are expected. The governance question is whether reviewers have sufficient visibility into what access enables to make a genuine determination, not whether revocations reach a minimum threshold.Revocation enforcement removes authority when justification ends, verified across connected systems with timestamps showing enforcement speed. Revocation is not workflow completion — it is permission removal, verified in connected systems, with timing that shows how quickly authority ended after justification ended.
Mechanism consequence
The joiner-mover-leaver lifecycle tests whether governance controls function. Each lifecycle event creates specific governance risks that reveal control gaps.Joiners require initial authority assignment. The governance risk is over-provisioning at hire — granting more than required or failing to scope authority to the specific role. Role-based provisioning that adds users to broad permission groups without role-specific scoping creates standing overprivilege. Assignment controls that cannot demonstrate approval decisions with business justification and defined scope leave authority grants unaccountable.Movers represent the highest-risk lifecycle event. When an identity changes roles, the new role requires authority; the old role's authority should expire. Role-change processes that add new access without reviewing and removing old access produce standing overprivilege that accumulates across every subsequent move. The governance exposure window is the gap between new authority grant and old authority removal.Leavers test revocation controls. Authority should terminate when employment ends. The governance risk is timing — how quickly does authority actually end, and does revocation propagate to all connected systems? Revocation processes that update directory records without verifying downstream system enforcement leave dormant accounts with persistent authority.Role lifecycle governance requires named ownership, periodic review of permission sets, and retirement when roles become unnecessary. Roles that accumulate permissions through exceptions become vehicles for privilege escalation. Role reviews that focus on role membership without examining role permissions miss the governance target — whether the role's authority still matches its purpose.Access reviews surface access for decision-making but do not automatically certify appropriateness. The governance value is in the decision and its consequences. Under NIST AC-6(7), the requirement is to validate need and remove or reassign privileges when no longer necessary — not to achieve a minimum revocation count. A review that confirms every grant is still justified is a valid outcome, provided reviewers have genuine visibility into what the access enables and can demonstrate that their decisions were informed ones.Test question: Can your review process show approval decisions, ownership assignment, review outcomes, and revocation verification with timestamps for each governance event?
Evaluation framework
Control type
What it governs
Failure indicator
Evidence required
Authority assignment
Which identities have which permissions, and under what justification
Permissions assigned without documented approver or business justification
Provisioning record with approver identity, justification, scope, and effective date
Ownership
Which person or team is accountable for each authority grant remaining justified
Access rights with no named current owner, or owners who cannot verify what access enables
Ownership assignment linked to specific access right, with last-confirmed date
Review effectiveness
Whether authority is still justified, verified by an accountable decision-maker with visibility into what the access enables
Reviewers without effective access visibility; near-zero revocation rates where upstream controls are known to be weak
Review record showing outcome (confirmed with justification / revoked), and for revocations: permission removal timestamp in connected systems
Revocation enforcement
That authority ends when justification ends, verified across all connected systems
Access persisting after departure, role change, or project end; slow propagation to downstream systems
Revocation record with triggering event, policy deadline, actual permission removal timestamp, and connected-system confirmation
Evidence production
That all four controls produce auditable records demonstrating authority is justified, current, and accountable
Inability to show which authorities changed, when, and under whose ownership
Audit trail: assignment → ownership → review outcome → revocation, with timestamps and owner identity at each stage
Each row in this framework maps to audit requirements in SOC 2 CC6.1 (logical access controls) and CC6.3 (access removal). (Source: AICPA Trust Services Criteria) The evidence column defines what auditors will request when validating governance control effectiveness.Verification steps for practitioners: Query your identity system to produce the assignment record for any high-privilege identity. Can you identify the approver, justification, and scope from the record? Can you identify the current owner and their last confirmation date? For any review that shows "approved" status, can you verify that authority in connected systems matches what the review claimed to evaluate?The tradeoff is governance overhead versus authority drift. Comprehensive evidence collection requires integration between identity systems, approval workflows, and downstream applications. The downstream implication: governance programs that cannot demonstrate authority control through audit trails indicate process compliance without operational security.
