Identity at Machine Speed: Why Access Governance Must Evolve Now

As enterprise application landscapes become more fragmented and increasingly automated identity and access governance (IAG) has shifted from a compliance exercise to a critical business risk discipline. In a recent SAPinsider Live podcast, I spoke with Manoj Makhija, Director of Professional Services at Pathlock, about why organizations continue to underestimate identity risk and what must change as AI accelerates access, automation, and exposure.

The Most Underestimated Risk: The Expanding Access Surface Area

Makhija emphasized that many organizations still lack a complete inventory of applications, identities, and entitlements across their ecosystem, a problem that has persisted for years and is now compounding with AI-enabled agents. Without a full system of record, enterprises cannot effectively manage risk because they don’t know what or who they’re securing.

One of the most consistent challenges Makhija sees across enterprises is the lack of a complete view into applications, identities, and access rights. Despite years of digital transformation, many organizations still don’t have a reliable system of record for access.

“Do I have a full system of record? Do I actually know what identities and access I’m controlling risk on?”
— Manoj Makhija, Pathlock

As AI agents are introduced, each with credentials and privileges, the access surface area expands rapidly. This gap becomes even more dangerous as organizations adopt AI and agent-based automation. Each Makhija points out that “with AI and agentic AI in the mix, this problem isn’t going away. It’s only going to increase.” According to Makhija, this is not a future-state concern, it is happening now, at scale, and at machine speed.

Cross-Application SoD: Where the Real Risk Lives

Another major blind spot is cross-application segregation of duties (SoD). While individual systems may appear compliant, risk often emerges when entitlements are combined across SAP, Oracle, and third-party SaaS platforms. Makhija noted that traditional tools still ask, “Who has access to what?” when the more dangerous question is, “What can someone actually do across the full landscape?”.

This is especially critical for finance processes such as vendor creation, invoice submission, and payment approval—where cross-system visibility is essential to prevent fraud.

Without cross-application SoD rule sets, organizations miss the compound risk created by overlapping permissions, particularly in critical finance and procure-to-pay processes.

Certifications Without Context Create Dormant Risk

Makhija also challenged the way organizations approach access certifications. Too often, certifications are treated as documentation exercises rather than active risk management. Manual reviews, stale spreadsheets, and lack of usage data result in organizations certifying access they don’t understand, in systems they can’t fully see.

“We are certifying access we don’t understand in systems we can’t see across for a reality that stopped being accurate the moment the last reorg happened.”

— Manoj Makhija, Pathlock

Unused administrative roles and dormant entitlements introduce silent exposure, risk that remains invisible until it’s exploited.

SAP Transformations: A Once-in-a-Decade Opportunity

With many organizations migrating from ECC to S/4HANA, Makhija stressed that SAP transformations represent a rare chance to eliminate years of accumulated access model debt. Sharing, “migration is your one clean window to retire 10-plus years of access model debt. Don’t defer it.”

Equally important, organizations must apply continuous controls monitoring (CCM) before cutover, not after, especially when ECC and S/4HANA run in parallel. He shares why before cutover is so critical, “Auditors don’t give you a grace period because you’re doing a migration. GRC has to be a go-live requirement.”

Identity Governance in an AI-First World

Looking ahead, Makhija challenged the assumption that AI-driven risk is a long-term concern. In reality, AI agents are already drafting contracts, triggering workflows, and approving transactions.

“The IGA playbook was built for humans at human speed. Agents operate at machine speed across multiple systems simultaneously. The old playbook doesn’t apply.”

— Manoj Makhija, Pathlock

As AI agents begin to outnumber human users, governance models must evolve bridging IGA and GRC to enable preventative, data-driven controls.

Listen to the full SAPinsider Live podcast featuring Manoj Makhija: