The gap between approved access and actual access.
Access drift is what happens between access reviews. Nuxari detects it continuously, not quarterly.
What is access drift
Access drift is the condition where a user's actual access in an external system differs from what was approved in Nuxari's access baseline. Drift is not inherently malicious. it may result from manual changes made outside approved workflows, integration failures, role inheritance changes, emergency access that was never revoked, or legacy accounts that were never properly offboarded.
Regardless of cause, access drift represents a deviation from the intended security state. Nuxari's job is to detect it, classify it, and surface it with enough context for a human to make an informed remediation decision.
Approved vs. observed access
Approved access is the access state that Nuxari has recorded as intentional and authorized. It is established through completed onboarding workflows, approved access request workflows, or explicit baseline imports during connector setup.
Observed access is what the connector reports as the current actual state from the external system, the ground truth pulled directly from Azure, GitHub, M365, or whatever system is connected.
When observed ≠ approved, a drift finding is created.
Severity classification
| Severity | Examples |
|---|---|
| Critical | Owner/admin role on production without approval |
| High | Elevated role (Contributor vs Reader) on sensitive resource |
| Medium | Inactive user with active license assignment |
| Low | Permission present but rarely used; offboarding cleanup candidate |
Real examples
Evidence at detection
When a drift finding is created, Nuxari immediately captures a snapshot of the observed access state, hashes it with SHA-256, and stores it immutably. Even if the access changes later, either through remediation or external action, the evidence of what was observed at detection time is permanently preserved.
This means that even if a finding is resolved manually outside the platform, the evidence that the deviation existed is retained and auditable.
Build the operating layer
for governance work.
See how Nuxari Ops reduces manual IT work, eliminates access drift, and generates audit evidence automatically, across your entire enterprise.