The Question The Stack Cannot Answer

The identity stack is excellent at managing policy and intent. It defines who should exist, what roles they should have and what access should be granted. It enforces authentication. It automates provisioning. It produces audit trails.

What it was never designed to do is tell you what authority actually exists across your environment right now.​

Authority pathways are the chains of relationships through which identities, roles, credentials and systems combine to create real operational control. In any enterprise of meaningful complexity, authority does not exist the way policy intends. It accumulates. A directory group inherits a role. That role carries permissions in a downstream system.

A service account created for a project that ended two years ago still holds credentials that connect to a production environment. A combination of entitlements across three platforms produces effective control over a system that no single platform's policy review would ever surface.

A cloud engineering team creates a temporary automation account during a migration project. The project ends, but the account remains active, still holding delegated administrative access into production Amazon Web Services (AWS) environments through a chain of inherited roles and cross-account trusts. No individual platform flags this as dangerous because each system only sees its own configuration.

And none of this accounts for the machine identities, automation accounts and non-human actors that hold significant authority and were never designed to flow through the human governance process at all.

This is not a failure of governance. It is the predictable result of managing a complex, dynamic environment through the lens of individual systems, each of which only sees its own piece of the picture.

The question that matters is simple: who actually holds authority across this enterprise, in total, today? Traditional systems were never built to answer this.

Why The Gap Is Structural, Not Operational

It is tempting to treat this as a process problem and simply implement better access reviews, more frequent audits, tighter provisioning controls. Those things would help, but they won't close the gap.

The gap is structural. Authority in a real enterprise is not a list of permissions, but a network of relationships. Identities connect to groups, groups inherit roles, roles grant authority across systems and credentials enable automation and delegation. Authority emerges from the connections between systems. No individual platform can see the connections it does not own.

This means organizations are governing identity policy while operating without visibility into the authority pathways those policies create. Access reviews tell you what policy intended. They do not tell you what authority actually formed after inheritance, role combinations and cross-system delegations played out across the environment.

Security incidents follow authority pathways. Most organizations do not have a map of those pathways.

The Incomplete Picture Has A Cost

When identity-driven incidents are examined after the fact, the pattern is remarkably consistent. Authentication was not the failure. The failure was structural: authority existed somewhere it should not have, and no one knew it was there.

A service account retained privileges that should have been removed. A nested group created an escalation path no one had modeled. A combination of roles produced unexpected control over a critical system, not because any single role was misconfigured, but because together they created something the individual platforms never flagged.

These are not exotic attack vectors. They are the normal byproduct of operating complex environments without a structural model of the authority that exists within them. These gaps will continue for as long as security teams are asked to manage authority risk using tools designed to manage policy intent.

What The Missing Layer Actually Requires

Closing this gap does not mean replacing the identity stack. Existing tools are doing their jobs. They need a complementary layer, a capability that sits across all of them and answers the question they were never designed to answer.

That capability must model the full network of relationships between identities, roles, credentials, systems and assets across human and non-human identities alike, and do it automatically, every day. A daily model that can be recomputed deterministically from authoritative enterprise state creates a historical and operational picture of how authority evolves.

With that model in place, the fundamental question becomes answerable. Not just today, but historically. Not just for known risks, but for structural exposures quietly forming in the background.

A Different Conversation About Identity Risk

For a long time, the conversation about identity security has been framed around tools: which provider, which governance platform, which privileged access management (PAM) solution. Those are important choices. But the missing layer is not another tool. It is a different kind of capability entirely, one that completes the picture the existing security stack creates.

Organizations that address the need for this capability tend to discover more than they expected. Not because their teams were failing, but because structural complexity allows authority to accumulate in ways genuinely invisible to tools designed to manage policy.

That discovery, however uncomfortable at first, is the beginning of genuine structural risk management.

The next phase of identity security will not be defined by better authentication or faster provisioning, but by whether organizations can finally see the full authority structures operating across their environments.

Forbes Technology Council is an invitation-only community for world-class CIOs, CTOs and technology executives. Do I qualify?