The Gap Between Policy and Enforcement
5 MIN ReadYour IAM policy looks great on paper. But when was the last time you actually tested it?
INTRODUCTION
Introduction
Identity and Access Management is one of the most documented, discussed, and debated domains in cybersecurity. Nearly every organization has an IAM policy. Most have tools in place — directories, single sign-on platforms, role-based access controls. And yet, year after year, IAM-related failures continue to appear in post-incident reports as root causes of major breaches.
So why does IAM keep failing?
The answer is rarely a lack of technology. It’s a gap — a persistent, often invisible gap — between what the policy says and what is actually enforced in the environment. This article breaks down where that gap comes from, why it persists, and what organizations can do to close it.
02 / IDENTITY & ACCESS MANAGEMENT
The Problem: Policies Are Written, Not Practiced
Most IAM policies are created in response to a compliance requirement, an audit finding, or a security incident. They are written by committees, approved by leadership, and then filed away. Rarely are they treated as living documents that must be tested, challenged, and validated against the actual access state of the environment.
The result is a dangerous illusion of control. Organizations believe their IAM posture is strong because the documentation exists. Meanwhile, the actual environment tells a very different story.
Common signs of the policy-enforcement gap include:
- Users with access to systems they no longer need, months or years after role changes
- Service accounts with broad administrative permissions that were provisioned for a short-term project and never decommissioned
- Shared credentials being used across teams with no accountability or traceability
- Access reviews being completed as checkbox exercises, with approvals rubber-stamped by managers who do not actually know what access their team members have
- Privileged accounts that exist outside the scope of Privileged Access Management (PAM) tools
03 / IDENTITY & ACCESS MANAGEMENT
The Root Causes
1. Provisioning Without Governance
Access provisioning is often fast and transactional. A new employee starts, a ticket is submitted, and access is granted — frequently with more permissions than the role requires, because it is easier to over-provision than to scope access precisely. The problem compounds when there is no structured process for modifying or removing that access as roles evolve.
2. Siloed Ownership
IAM sits at the intersection of IT, security, HR, and business operations. But in many organizations, no single team owns the full lifecycle. HR manages onboarding. IT manages provisioning. Security manages the policy. And no one owns the deprovisioning loop. When responsibility is fragmented, accountability disappears.
3. Certification Fatigue
Access reviews — also called access certifications — are a core control in most IAM programs. But when managers receive a spreadsheet of 200 access records and are asked to review them by Friday, the review becomes performative. Research consistently shows that bulk approvals in access certification campaigns indicate that reviewers are clicking “approve” without meaningful evaluation.
4. Technical Debt in Identity Systems
Legacy systems often lack modern IAM integration capabilities. When a system cannot be connected to the enterprise directory, access is managed locally — manually, inconsistently, and usually invisibly to the central IAM team. These systems become blind spots in the identity estate.
04 / IDENTITY & ACCESS MANAGEMENT
What Enforcement Actually Looks Like
Enforcement is not just about having the right policies. Enforcement requires that:
- Access is provisioned based on verified need, not convenience
- Permissions are regularly reviewed and right-sized against current role requirements
- Deprovisioning is triggered automatically when role changes or terminations occur
- Privileged access is time-bound, audited, and subject to approval workflows
- Policy violations generate alerts, not just log entries
The difference between a mature IAM program and an immature one is not the sophistication of the tool stack — it is the operational discipline applied to identity lifecycle management.
05 / IDENTITY & ACCESS MANAGEMENT
Closing the Gap: Practical Recommendations
1. Conduct an entitlement audit. Before writing a new policy, understand what access actually exists in the environment. This means pulling current access data from all identity-aware systems and comparing it against what should exist based on current roles and responsibilities.
2. Tie IAM to HR workflows. Joiner-mover-leaver processes should be automated. When an employee changes roles or leaves the organization, access changes should follow automatically — not through a manual ticket that may or may not be submitted.
3. Redesign access reviews for quality. Reduce the volume of records presented to each reviewer. Provide context for each access item. Flag anomalies and high-risk entitlements for priority review. Make it easy for a reviewer to take action — not just click approve.
4. Measure the gap, not just the policy. Define metrics that reflect the actual state of access, including: number of orphaned accounts, average time to deprovision after termination, percentage of privileged accounts enrolled in PAM, and access review completion rates with meaningful revocation rates.
5. Test your controls. Treat IAM controls like any other security control — test them. Penetration testing and red team exercises that specifically target identity paths can reveal enforcement failures that audits and reviews miss.
KEY TAKEAWAYS
Key Takeaways
Recap: Having an IAM policy is not the same as having IAM enforcement. The gap between the two is where breaches happen.
- IAM failures are most often operational, not technical
- Access accumulates silently and becomes a liability without active lifecycle management
- Access reviews are only valuable if they are designed to produce real decisions
- Enforcement requires measurement — metrics that reflect actual access state, not policy documentation
- Testing IAM controls is as important as testing any other security domain
The organizations that close the gap between policy and enforcement do not necessarily have the best tools. They have the best processes, the clearest ownership, and the discipline to treat identity management as an ongoing practice — not a one-time implementation.
Security / Strategy / Trust
Security isn't just technology.
It's trust.
Exploring identity, security strategy, AI security, and the human side of cybersecurity.
