By this point in the series, a pattern should be clear.
Disabling accounts is not governance.
File shares drift without lifecycle controls.
Cloud and SaaS platforms do not enforce intent on their own.
The next assumption many firms make is more subtle—and more dangerous:
“At least access is identity-based now.”
Identity-based access feels safer.
In practice, without governance, it often increases risk.
The Perimeter Is Gone—and That Changes Everything
For decades, firms relied on implicit controls:
Office networks
VPN access
Domain-joined devices
Physical presence
These were not perfect controls, but they created natural friction.
Cloud platforms removed that friction by design.
Today:
Access works from anywhere
Any device can become trusted
Location no longer limits exposure
Identity is the primary gate
This shift is powerful.
It is also unforgiving.
Identity Is a Switch, Not a Boundary
Identity-based systems answer one question extremely well:
Is this person authenticated?
They do not automatically answer:
What should this person see?
Why should they see it?
How long should access persist?
What happens when their role changes?
Identity is binary.
Governance is contextual.
Without governance, identity becomes a master key.
How Identity Mistakes Scale Instantly
In legacy environments, mistakes were constrained:
Access required network presence
Devices mattered
Physical proximity mattered
In identity-driven environments:
A single misconfigured group
A single inherited role
A single forgotten external user
Can expose data globally.
There is no gradual failure.
There is no warning phase.
There is only scope.
Example:
A firm adds an outside litigation consultant to an Azure AD group for “temporary access” to discovery materials. The group was created three years ago for a different matter and has accumulated access to 47 SharePoint sites across 12 active cases. The consultant’s identity now grants immediate access to all of them—from any device, any location, indefinitely. No one notices. Nothing alerts. The scope of exposure does not surface until a conflict check, audit, or breach investigation forces the question: “Who could see this?”
The Illusion of Control
Firms often point to:
MFA enforcement
Conditional access policies
Device trust rules
Login monitoring
These are important controls.
But they govern how someone logs in, not what they can access once inside.
Strong authentication protects the door.
Governance protects the rooms.
Most firms invest heavily in the former and assume it covers the latter.
It does not.
Why Identity Drift Is Harder to See
Identity-based drift is less visible than file share drift because:
Access is abstracted behind roles and groups
Permissions are inherited silently
Group membership persists across role changes
External collaborators remain valid identities
From the user’s perspective, everything works.
From the system’s perspective, nothing is wrong.
The exposure exists only in relation to intent—and intent is rarely encoded.
When Identity-Based Access Fails Under Scrutiny
When questioned, firms are often asked:
Why did this user have access?
What role justified it?
When should it have ended?
Was access reviewed?
Who approved it?
Identity systems alone cannot answer these questions.
They can show:
That access existed
That authentication succeeded
That activity occurred
They cannot show:
That access was appropriate
That distinction matters when accountability is examined.
Why Zero Trust Alone Is Not Enough
Zero Trust is often presented as the solution.
In practice, Zero Trust:
Verifies identity continuously
Evaluates device posture
Enforces authentication rigor
But Zero Trust does not define business intent.
It assumes:
“If identity is verified, access decisions are correct.”
That assumption fails without governance layered on top.
Zero Trust without governance becomes high-confidence access to poorly defined scopes.
The Compound Risk of Identity and Convenience
Cloud platforms reward speed:
Fast onboarding
Easy sharing
Flexible collaboration
Minimal friction
Identity systems amplify that speed.
Without governance:
Access expands faster than oversight
Temporary access becomes permanent
External identities linger indefinitely
Role changes accumulate permissions
The system works exactly as designed.
The risk emerges because no one told it when to stop.
What Governance Adds to Identity
Governance does not replace identity systems.
It constrains them.
In a governed identity model:
Identity grants eligibility, not entitlement
Access is scoped to matters, not roles alone
Time limits are enforced automatically
Role changes trigger access reevaluation
External identities expire by default
Reviews are mandatory, not optional
Identity becomes a control plane—not a liability.
Why This Matters to Firm Leadership
Identity failures are rarely framed as governance failures—until they are.
When incidents occur, firms are no longer asked:
“Was the user authenticated?”
They are asked:
Should they have had access at all?
Why did access persist?
Who was accountable for that decision?
At that point, identity controls offer little defense.
Governance does.
The Takeaway
Identity-based access did not make firms less secure.
It made mistakes scale faster.
Without governance:
Access becomes overly permissive
Exposure becomes invisible
Accountability becomes unclear
Identity answers who you are.
Governance answers what you are allowed to do, and why.
Confusing the two is now one of the most common—and costly—errors in modern legal environments.
Where This Leads Next
In the next article, we will bring the series together:
What practical, enforceable governance actually looks like—and how firms move from assumption to continuous assurance without disrupting operations.
For now, the conclusion is simple:
Identity without governance is not control.
It is acceleration.
About the Author
James Phipps is CEO of BeCloud, an advisory firm specializing in governance frameworks for compliance-intensive organizations. BeCloud works with legal services organizations, healthcare providers, and professional services firms to design infrastructure where security and compliance are embedded by design rather than retrofitted after deployment.