Scaling an identity platform to over a billion user identities taught me something I did not expect, which is that the expensive part of identity is almost never the authentication.
Authentication is a solved problem with a competitive market. The expensive part is everything that accumulated around it: the entitlement that was granted once for a project that ended, the integration built against a directory attribute that three teams now depend on, the group whose membership rule nobody can explain but which appears in eleven access policies.
That accumulation is identity debt, and it charges interest in currencies that do not appear on a security budget.
How it presents
As onboarding time. A new engineer takes nine days to become productive because access requests route through four systems and two of them require a human who is in a different timezone. Nobody codes this as an identity problem. It gets discussed in an engineering leadership meeting as a hiring ramp issue.
As a recurring audit finding. The same access review finding appears three years running. Each year it is remediated in the specific instances the auditor sampled, and each year the underlying process stays the same, because fixing the process costs a quarter and fixing the samples costs a week.
As migration cost. This is the big one and the one that surprises people. Every directory migration, identity provider change, or acquisition integration is priced on the number of applications. It is actually priced on the number of undocumented entitlement dependencies, which is a number nobody has. Estimates come in at one quarter and land at three, reliably enough that I now apply a mental multiplier of three to any migration estimate produced before an entitlement inventory exists.
As an inability to say no. A team with identity debt cannot refuse a bad access request, because refusing requires being able to state what the correct access is, and that statement is exactly what the debt has erased.
Why it accumulates
Identity debt accumulates faster than other technical debt for a structural reason: granting access is a service and revoking it is a cost.
When somebody needs access, there is a named person asking, a business reason, and a delay if you say no. When access should be removed, there is no requester, no deadline, and a nonzero chance of breaking something. Every incentive in the system points one direction, and over five years the direction compounds.
This is also why access reviews fail as a remedy. A quarterly campaign asks a manager to certify thirty entitlements they did not grant and do not understand, under time pressure, with an approve-all button available. The rational move for that manager is to approve all, and the review produces a record without producing a change.
What actually reduces it
Three things, in rough order of effect.
Time-bound access by default. An entitlement that expires does not need to be revoked, which removes the asymmetry entirely. This is the single highest-value change available and it is mostly a policy decision rather than a purchase, though it needs an identity provider that supports expiry natively.
Ownership at the group, not the person. If a group has a named owner accountable for its membership rule, the review question changes from "should this person have this?" to "is this rule still correct?" The second question is answerable by someone who actually knows.
A migration as a forcing function. Unpleasant, but true. The only times I have seen large-scale entitlement cleanup actually finish were when a migration made it unavoidable. If a migration is coming, budget the cleanup inside it rather than promising it separately afterward, because separately afterward never happens.
How to measure it before you argue about it
The case for cleanup is much stronger with three numbers than with an adjective, and all three are obtainable in a day.
Entitlements per employee, over time. Total distinct grants divided by headcount, sampled at three points across two or three years. If it rises while headcount stays flat, access is accumulating rather than turning over. That single trend line is the most persuasive artifact in this whole territory, because it makes an invisible process visible.
Median time to first productive access for a new starter. Ask the last five new joiners how long before they could do their job. Engineering leadership cares about this number a great deal, and it converts an identity problem into a hiring-velocity problem, which has a bigger budget attached.
Share of entitlements with no recorded justification. Sample fifty grants at random and try to find why each exists. The proportion you cannot explain is your debt ratio, and in most organizations that have not done this before, it lands somewhere north of half.
Take those three to an engineering leader rather than a risk committee. The audience matters as much as the numbers.
The limit of this
Identity debt is not the same as a security risk, and conflating the two damages the argument. Most stale entitlements are never exercised and never will be. The security case for cleanup is real but modest, and a security leader who oversells it will be right eventually and unconvincing today.
The stronger case is operational, and it belongs to whoever owns engineering productivity and whoever owns the next migration. Those two people will fund identity cleanup out of budgets larger than yours, if you frame it in their terms rather than in the language of risk.