Measuring What Moves

Identity Governance and Administration (IGA) programs are designed to ensure that appropriate access is maintained across organizational resources. However, the operational metrics used to evaluate these programs remain overwhelmingly static and activity-based: certification completion rates, provisioning speed, and policy violation counts. These metrics measure whether governance work was performed, not whether the governance program is keeping pace with the rate at which access states change.

This paper examines the gap between the continuously evolving nature of access environments and the periodic, checkpoint-based governance models that most organizations rely on. We propose four named metrics, Entitlement Drift Rate, Governance Lag, Justification Half-Life, and Trust Gradient, designed to function as program-level indicators of governance responsiveness, analogous to the role DORA metrics play in measuring software delivery performance. The framework is applied to both human and non-human identity (NHI) governance contexts, positioned not as a replacement for existing IGA measurement approaches but as a complementary layer that captures the dynamic properties current metrics do not address.

The four metrics in this paper are now the Operational Metrics Specification of the Open IGA Operating Framework, an open framework for running an identity governance program. Two mappings are confirmed, and two are proposed pending pilot data.