Question 1

How do you recognize it?

Accepted Answer

Client credentials, API keys, and service tokens live in a shared spreadsheet or a single team vault with no per-user audit trail. Offboarding takes days because nobody can confirm which client environments a departing contractor still has keys for. Access reviews before a client security questionnaire turn into a manual scramble across four consoles and two password managers. A single reused admin password shows up across multiple client tenants, discovered only during an incident or pen test. Secrets get pasted into Slack, Notion, or agent prompt files because the sanctioned store is slower than the shortcut.

Question 2

Why does it happen?

Accepted Answer

Teams treat IAM as a login problem and stop at SSO, leaving secrets, service accounts, and machine credentials outside any governed store. Unified platforms get bought for the human directory while non-human identities are provisioned ad hoc by whoever ships fastest. No owner is assigned to the access lifecycle, so provisioning is automated but deprovisioning stays manual and reactive. Client compliance requirements differ per account, and agencies default to the loosest common denominator to avoid per-client configuration work.

Question 3

How do you fix it?

Accepted Answer

Inventory every secret, token, and service account across active client accounts this week and tag each one with an owner and a rotation date. Move shared client credentials into a vault with per-user access and event logging, then revoke the spreadsheet and the shared login. Wire deprovisioning to your HR or contractor roster so removing a person from the directory closes their client access the same day. Run one access review per client retainer before the next renewal and hand the client the export as part of the security conversation.

More for IAM Access Control