Free toolkit, Chapter 18, Metrics That Matter
The metric library
The metrics Chapter 18 names, written out so you can produce each one, own it, and act on it. Then how to decide when each one turns yellow or red.
Chapter 18 names the metrics and stops short of the thresholds, on purpose, because thresholds belong to your organization's risk appetite and not to a book. This page is the fuller version: a populated library organized by the five pillars, and guidance for setting green, yellow, and red lines you can defend.
A dashboard that only turns red after the damage is done is not measurement. It is a memorial. The Modern Identity Operating Model, Chapter 18
In brief
- Twenty-two metrics, organized by the five pillars, with AI identity gathered at the end. Do not stand them all up: start with three to five from your weakest pillar.
- Every metric names an owner, a source, and the action it should trigger. A number nobody acts on is theater.
- The book leaves thresholds to you on purpose. Eight rules show how to set green, yellow, and red lines you can defend, and why you never average a red away.
Go to the metricsGo to the threshold rulesAbout 20 minutes to read in full
This page extends Chapter 18, Metrics That Matter of The Modern Identity Operating Model.
Before you take anything from here
A library is not a dashboard
There are twenty-two metrics below. Please do not stand up all twenty-two. The book is blunt about this: a wall of numbers no one acts on is theater, and it costs real time to maintain. Start with three to five from your weakest pillar, the ones that would make you do something differently next week if they moved. Add another only when a decision is waiting for it.
Each entry is written so you can lift it straight into the Identity Metrics Starter, which asks for the same things in its columns, and from there into the reporting dashboards at each altitude.
How to read an entry
Every entry carries the same fields
- Definition and formula. The arithmetic, written down. If "offboarded" means deprovisioned in the application to one team and disabled in the directory to another, the combined number means nothing.
- Source. Named by the four jobs: Source, Registry, Governance, Enforcement. Most good metrics compare what was decided against what actually took effect.
- Owner and cadence. The role accountable for producing it and acting on it, and a frequency matched to how fast the thing can change. A gap in the dashboard is usually an ownership gap underneath.
- Type. Leading or lagging, and the book's quieter distinction: performance (how you are doing) or risk (what might harm you). Thresholds tied to risk appetite belong mainly on the risk metrics.
- Altitude. How it reads as it climbs, from operational to governance to executive. At the board it becomes part of its pillar's color and arrow.
- Predictability and drift. The field that matters most. If you cannot fill it in, the metric is probably measuring activity.
Chapter 18 puts the test in one line:
A metric is only useful if it can tell you something is wrong while you can still do something about it.
The library
Twenty-two metrics, by pillar
Organized by the five measurement domains in Chapter 18, with AI identity gathered at the end so you can see it whole, though each AI metric names the pillar it reports under. The book does not want a separate AI dashboard. Neither do I.
Owners are written as roles. Map them onto the names in your own organization, because the pattern is portable and the org chart is not.
Governance · Is ownership getting clearer?
Decisions and ownership. When these slip, every other pillar's data gets fuzzy, because no one is accountable for producing it.
G1Access roles with named owners
Access roles that have a named, current owner, as a share of all access roles in scope. Formula: roles whose owner is a named person still active in the HR source, divided by all roles. "Current" matters: an owner who left last spring still shows up as a name.
Source: Governance (ownership map), checked against Source (HRIS). Owner: IAM lead. Cadence: monthly. Type: leading, risk. Altitude: list of unowned roles per system; ownership rate and trend; "ownership clarity improving or not."
Predictability and drift: A role name only means something if someone answers for it. A falling rate is the earliest sign that roles are becoming labels no one can explain.
G2Exception volume, age, and repetition
How many exceptions are open, how old they are, and how many keep coming back. Formula: open count; median and oldest age; share past expiration; count with no expiration at all; count of exceptions against the same standard in the last twelve months.
Source: Governance (exception record, risk register). Owner: governance sponsor, with GRC. Cadence: monthly. Type: age and expiry are leading; repeated exceptions are lagging. Risk. Altitude: each exception and its owner; volume, age, and clusters; "where the model does not fit the work yet."
Predictability and drift: Exceptions cluster where the model does not fit reality. An exception past its date has quietly become a deviation again, and one with no date at all is, in the book's word, a pet.
G3Ownerless privileged objects
Privileged accounts, groups, service accounts, and secrets with no named owner. Formula: count, and count as a share of privileged objects, tracked month over month.
Source: Registry (directory, privileged access inventory) against Governance (ownership map). Owner: IAM lead. Cadence: monthly. Type: leading, risk. Altitude: named objects; count and trend; folded into privileged exposure.
Predictability and drift: This is where the migration account that outlived its migration lives. Anything privileged without an owner is a surprise scheduled for later.
Lifecycle · Is identity reflecting reality?
Whether access follows the person, or the account, or the agent, through joining, moving, and leaving. Split every lifecycle metric by population. Averages hide contractors.
L1Leaver events deprovisioned within policy
The book's 88 percent example. Formula: leaver events fully deprovisioned within the policy window, divided by leaver events in the period, reported separately for employees and non-employees. Write down what "fully deprovisioned" means before anyone counts anything.
Source: Source (HRIS, vendor management) for the event; Enforcement (deprovisioning logs, target systems) for completion. Owner: lifecycle operations. Cadence: monthly. Type: lagging, risk. Altitude: 132 of 150 on time, 18 late; 88 percent, down from 94; "offboarding exposure rising in the contingent workforce."
Predictability and drift: Leaving is where informal process fails silently. A rate that holds steady is the clearest evidence lifecycle is predictable. A slip concentrated in one population tells you exactly where.
L2Non-employees active past end date
Contractors, consultants, and vendors whose access outlives their recorded end date. Formula: count active past end date, the longest overage in days, and count with no end date recorded at all.
Source: Source (vendor management or sponsor records) against Registry and Enforcement. Owner: lifecycle operations, with sponsors. Cadence: weekly where you can, monthly at least. Type: leading, risk. Altitude: named people and sponsors; count and longest overage; part of the offboarding story.
Predictability and drift: For a contractor, the end date is often the only thing that will ever say they are gone. A blank end date is drift that has not happened yet.
L3Transfer completion accuracy
When someone moves roles, whether the old access leaves on time. Formula: transfers where prior-role access was removed or re-approved within the window, divided by all transfers; plus median days that old access lingers.
Source: Source (HRIS job change) against Enforcement. Owner: lifecycle operations. Cadence: monthly. Type: leading, risk. Altitude: transfers with lingering access; accuracy and linger time; rarely shown above governance on its own.
Predictability and drift: How long access lingers after a role change is one of the leading indicators the book names directly. Movers are where accumulation starts.
L4Nonhuman identities with lifecycle metadata
Service accounts, workloads, and integrations carrying an owner, a purpose, and a review or expiry date. Formula: nonhuman identities with all three, divided by nonhuman identities in the registry.
Source: Registry (nonhuman identity register). Owner: IAM engineering, with application owners. Cadence: monthly. Type: leading, risk. Altitude: identities missing fields; completeness rate; "nonhuman identity under governance or not."
Predictability and drift: A nonhuman identity has nobody to notice when it should have been retired. The metadata is the only thing that will.
L5Orphaned accounts
Accounts in target systems that correlate to no active identity. Formula: count found per reconciliation, and how many were found again in the next one.
Source: Registry (correlation) against Enforcement (target accounts). Owner: IAM engineering. Cadence: per reconciliation, at least monthly. Type: lagging, risk. Altitude: account list; count and trend; folded into lifecycle status.
Predictability and drift: Every orphan is a lifecycle event that did not finish. A count that keeps refilling means the fix was a cleanup, not a process.
Access · Is capability becoming more intentional?
Whether access has a purpose someone can state, and whether privilege stands only where it has to.
A1Privileged access time-bounded versus standing
The book's 62 percent example. Formula: privileged assignments that are just-in-time or time-bounded, divided by all privileged assignments; plus the number of systems with no just-in-time at all.
Source: Enforcement (privileged access tooling, target systems) reconciled to Registry. Owner: security operations, with system owners. Cadence: monthly. Type: leading, risk. Altitude: 14 of 40 admin accounts standing on the payroll system; 62 percent across all systems, up from 48, 4 systems at zero; "standing privilege down about 30 percent this year."
Predictability and drift: Standing privilege creeping up is the book's own example of risk building toward a line. Watch the direction, not the snapshot.
A2Entitlements with owners
Entitlements in scope with a named owner and a stated purpose. Formula: owned and described entitlements, divided by all entitlements, starting with privileged and regulated ones.
Source: Governance (access model, entitlement catalog). Owner: access owners. Cadence: quarterly. Type: leading, risk. Altitude: entitlements missing owners; coverage rate; part of "access becoming more purposeful."
Predictability and drift: An entitlement can outlive every reason it was created and still look healthy on paper. Ownership is what lets anyone notice.
A3Review action rate
The book's 3 percent example. Formula: items revoked or modified, divided by items reviewed, per campaign and per reviewer; read next to median seconds per decision and the share of approved items unused in 90 days.
Source: Governance (review records) with Enforcement (usage data). Owner: IAM lead, with access owners. Cadence: per campaign. Type: leading, performance and risk. Altitude: 6 of 200 actioned in 4 minutes; 100 percent on time, 3 percent action rate; "reviews look complete but are not yet doing their job."
Predictability and drift: A low action rate on clean access is fine. A low action rate on access no one has used in a year is a rubber stamp. That is why it never travels alone.
A4Dormant privileged access
Privileged accounts or assignments with no use in 90 days. Formula: dormant privileged assignments, divided by all privileged assignments.
Source: Enforcement (authentication and activity logs). Owner: security operations. Cadence: monthly. Type: leading, risk. Altitude: "3 unused in 90 days"; dormant rate; folded into standing privilege.
Predictability and drift: Unused privilege is accumulation made visible. It is also the easiest evidence to put in front of a reviewer.
Technology · Is the environment more reliable and observable?
Many identity outages are governance failures that finally came due. These metrics catch them before the pager does.
T1Failed provisioning and deprovisioning events
Formula: failed or manually retried operations, divided by all operations, with failed deprovisioning counted on its own line.
Source: Enforcement (connector and workflow logs). Owner: IAM engineering. Cadence: weekly. Type: leading for deprovisioning failures, lagging for the rest. Performance, with a risk line. Altitude: failed jobs by connector; failure rate and trend; rarely above governance.
Predictability and drift: A failed deprovisioning is an orphan being born. It should never be averaged in with a slow joiner request.
T2Secrets and certificates past renewal threshold
Formula: credentials inside their renewal window with no planned renewal, plus credentials past expiry still in use. Pair it with the lagging line: credential-related outages in the period.
Source: Registry (certificate and secret inventory). Owner: platform team. Cadence: weekly. Type: leading, risk; outages are lagging. Altitude: named credentials and owners; count and outage trend; "credential outages: none this quarter, or not."
Predictability and drift: A certificate without an owner is an outage waiting for a date on the calendar. Renewals done as emergencies are the drift signal.
T3Telemetry completeness
Formula: in-scope systems sending identity events (changes, privileged use, failures) to where someone actually looks, divided by in-scope systems, weighted toward the critical tier.
Source: Registry (system catalog) against the monitoring platform. Owner: IAM engineering, with security operations. Cadence: quarterly. Type: leading, risk. Altitude: systems not reporting; coverage rate; "how much of the estate we can see."
Predictability and drift: Drift often appears first as signal, not incident. Where there is no telemetry, there is no early warning, only the incident.
People & Change · Is the model being absorbed?
Operational metrics tell you whether the system is functioning. These tell you whether people are participating in the model the way it needs them to.
P1Approver training completion
Formula: approvers and reviewers who completed role-based training before their first decision, divided by all active approvers and reviewers.
Source: learning records against Governance (approver list). Owner: IAM lead, with the change lead. Cadence: quarterly. Type: leading, performance. Altitude: who has not completed; completion rate; part of People & Change status.
Predictability and drift: Training is only a leading indicator if it shows up later in A3. If completion rises and action rates do not, the training is not changing decisions.
P2Owner participation
Formula: owner decisions (approvals, reviews, exception sign-offs) completed on time with a real decision recorded, divided by decisions assigned.
Source: Governance (workflow and review records). Owner: governance sponsor. Cadence: monthly. Type: leading, performance. Altitude: owners who are not responding; participation rate; "owners are carrying their part, or not."
Predictability and drift: When owners stop responding, decisions route back to the identity team, and the model quietly reverts to running on a few heroic people.
P3Adoption of new workflows
Formula: access changes that came through the official path, divided by all access changes found in reconciliation, including the ones that came through a direct message to an administrator.
Source: Governance (request records) against Enforcement (actual changes). Owner: IAM lead. Cadence: monthly. Type: leading, performance. Altitude: side-channel changes by team; adoption rate; part of People & Change status.
Predictability and drift: The workaround is a signal. A team going around the form is usually telling you the form does not work for them yet.
AI identity · In the same operating truth
Each of these reports under a pillar, shown in brackets, so AI never sits on a dashboard of its own.
AI1Agents with completed intake and a named sponsor [Governance]
Formula: active AI agents and AI systems with a current intake, a stated purpose, and a named sponsor, divided by all active AI identities found, including the ones found by discovery rather than declared.
Source: Governance (intake records) against Registry and Enforcement. Owner: IAM lead, with agent sponsors. Cadence: monthly. Type: leading, risk. Altitude: agents without intake; coverage; "AI governance posture."
Predictability and drift: The denominator is the honest part. A hundred percent of the agents you declared is not a hundred percent of the agents you have.
AI2AI actions outside delegated boundaries [Access]
Formula: count of actions observed outside the agent's documented boundary, including authority beyond what its principal holds.
Source: Enforcement (access and activity logs) against Governance (boundary records). Owner: agent sponsors, with security operations. Cadence: continuous where telemetry allows, reviewed monthly. Type: lagging, risk. Altitude: each event; count and trend; escalated as an event, not a rate.
Predictability and drift: This is the AI misbehavior escalation the book lists among lagging indicators. Treat it as an event threshold, covered below.
AI3AI lifecycle review completion [Lifecycle]
Formula: AI identities reviewed on their scheduled cadence, divided by AI identities due, with agent-created identities counted, each of which should carry an expiration or review date from the moment it exists.
Source: Governance (review records), Registry. Owner: agent sponsors. Cadence: quarterly. Type: leading, risk. Altitude: overdue reviews; completion rate; part of AI governance posture.
Predictability and drift: AI access review sitting outside normal governance cadence is one of the questions the book says a working measurement model makes people ask.
AI4AI telemetry coverage [Technology]
Formula: AI identities whose actions are logged where someone reviews them, divided by active AI identities. Note separately the agents whose reach extends past a credential you control.
Source: Registry against the monitoring platform. Owner: IAM engineering. Cadence: quarterly. Type: leading, risk. Altitude: unmonitored agents; coverage; "how much AI activity we can see."
Predictability and drift: An agent is governable to the degree its authority runs through something you control. This metric is how you say where that stops, plainly, instead of pretending the gap is covered.
Threshold guidance
Where the lines come from
A threshold is a risk decision wearing a number. That is why the book does not give you one. The same 88 percent is acceptable in one organization and a red line in another, and the difference is not the data. It is how much unresolved identity risk each organization has decided it can carry.
Chapter 11 gives the definition everything below rests on:
Risk appetite is how much unresolved identity risk the organization is willing to tolerate while the model matures.
The chain runs in three steps. Appetite is the broad statement, usually owned by leadership and GRC. Tolerance turns that into something specific and measurable for one kind of risk. Thresholds are the green, yellow, and red bands on a single metric that tell you where you stand against the tolerance. NIST's Cybersecurity Framework 2.0 asks for exactly this translation: risk appetite and risk tolerance statements that are established, communicated, and maintained, with appetite turned into specific, measurable tolerance statements people can understand.
If your organization has no written appetite, you will not fix that from the identity team, and you do not need to wait for it. Read the appetite the way Chapter 11 says to: watch the budget as closely as the policy. A low stated appetite with no money behind it means the risk will be carried, not closed, and your thresholds should say so honestly rather than promise a red line no one will fund a response to.
Setting the bands
Eight rules for thresholds you can defend
- Only set a threshold on a metric with an owner, a source, and an action. The Identity Metrics Starter asks for all three, and a metric missing any of them is not ready. A threshold with no action behind it only decides what color to paint the memorial.
- Measure before you set. Run one or two cycles to get a baseline. A threshold set before you know where you are is a guess, and the first month will either flood the page with red or bury a real problem in green.
- Red is the tolerance line. Red means the organization's stated tolerance has been crossed. It does not mean "worse than we would like." If red is set tighter than the tolerance, the page cries wolf. If it is set looser, it lies.
- Set yellow by lead time. Yellow is the early warning, and it has to fire early enough to act. If closing the gap takes a quarter, yellow has to trigger at least a quarter before the line. This is the rule that makes a leading indicator earn its name.
- Give every yellow a dwell time. Chapter 11 says appetite shapes how long an unstable condition can stay that way before it becomes unacceptable. Write that number down. A metric that sits in yellow past its dwell time escalates as if it were red.
- Use event thresholds where one is too many. Some risks are not rates. An AI action outside its delegated boundary, a privileged object found with no owner, a non-employee active well past an end date: each of those can be a red on the first occurrence, regardless of the overall percentage.
- Lower appetite moves the lines, not the metric. A lower appetite means a narrower green, an earlier yellow, a shorter dwell time, and more event thresholds. The definition and the formula stay the same, so the trend stays comparable when appetite changes.
- Thresholds are signed, not set. The identity team proposes. Whoever owns the risk agrees, usually through GRC, which owns who can accept what level of risk. Revisit the bands when the appetite is revisited, and at least once a year.
A note on how this fits the starter. The Identity Metrics Starter asks you to write the target as a condition, not a single number, so it does not go stale. Keep doing that. The condition is what good looks like. The bands are this year's calibration of how far from that condition you are willing to drift before acting, and they are expected to move.
Worked example · illustrative only
One number, three appetites
These bands are invented for illustration. They are not benchmarks, not recommendations, and not drawn from any study. They exist to show how the same reading changes color when the appetite behind it changes.
Take L1, leaver events deprovisioned within policy, and the book's governance reading: 88 percent this month, down from 94, the slip entirely in contractors, with one contractor still active six days past the end date. Here is how three organizations with different appetites might band it.
Higher appetite
Green at 90 percent or above. Yellow from 85 up
to 90. Red below 85. Event red: any non-employee active more than 10 days past end date.
Yellow dwell time: two months.
This reading: yellow, failing. Below green and
moving the wrong way, but not past the line.
Moderate appetite
Green at 93 percent or above. Yellow from 90
up to 93. Red below 90. Event red: any non-employee active more than 5 days past end date.
Yellow dwell time: one month.
This reading: red, failing. 88 percent is past
the line, and so is the contractor at day six.
Low appetite
Green at 98 percent or above. Yellow from 92 up to
98. Red below 92. Event red: any non-employee active past end of the next business day. No
yellow dwell time; yellow goes to governance at once.
This reading: red,
failing. It was already yellow last month at 94.
Notice what the low-appetite organization gains. Last month's 94 percent was green on two of these three pages, and the slide toward contractors had already started. A tighter yellow saw it a month earlier. That is the whole argument for leading indicators, made with a lagging metric and an honest band.
The other two book examples band the same way. With a moderate appetite, A1 at 62 percent time-bounded, up from 48, might read yellow and improving, which is what the book's board page shows for Access. A3 is the instructive one. On-time completion at 100 percent is green on any band you choose. The action rate at 3 percent, read next to the share of approved access no one has used in 90 days, is where the review's real status lives. Completion tells you the process ran. The pairing tells you whether it did its job.
How thresholds escalate
Awareness climbs. The action stays put.
The book is careful about this. The roll-up carries awareness upward, but the fixing stays with the people who own the systems. Escalation is how a risk reaches someone who can make a call or put weight behind the work, on purpose, before it surprises them. A workable ladder looks like this.
1Yellow, inside dwell time: operational
The metric owner and the system owner act within their normal cadence. It shows on the operational view and nowhere else yet. Most yellows should end here.
2Yellow past dwell time, or yellow in several systems: governance
It goes to the sponsor or review body. It leaves with a named owner and a date. If the fix will take longer than the dwell time allows, it becomes a documented exception or a tracked remediation plan in the risk register.
3Red: executive
It reaches the executive named on your escalation line, with a clear ask: a decision, funding, or weight behind a team that is not moving. The executive view reads like the book's: one control gap, with an owner and a date.
4Red that will not be fixed: formal acceptance
If the organization decides to carry it, someone with the authority to accept that risk signs a time-bound acceptance, usually with a compensating control. It lives in the risk register and comes back on a date. A red no one has accepted and no one is fixing is the worst status on the page, whatever color it shows.
5Event thresholds: straight to the owner
Events skip the ladder. An agent acting outside its boundary goes directly to its sponsor and to security operations, the same day, then joins the ladder at whatever level the response needs.
Who stands at each rung depends entirely on your organization. In one company the identity director holds the budget. In another the authority sits in IT, in the business units, or with a risk committee. Write the names onto the ladder where decisions are actually made.
Rolling up to the board
Never average a red away
At the top, each pillar collapses into a color and an arrow. The roll-up rule decides whether that page tells the truth. One approach that holds up:
- Red if any risk metric in the pillar is red with no owned plan or signed acceptance behind it.
- Yellow if any risk metric is yellow, or red with an owned plan and a date.
- Green only if every risk metric in the pillar is green.
- The arrow comes from the trend of the pillar's risk metrics over at least two periods: improving, stable, or failing. It is never left off.
The worst metric sets the color because averaging hides exactly what the board needs to see. Four green metrics and one red one do not make a pillar mostly fine. They make a pillar with a red in it.
Run the book's own example through that rule. The board page in Chapter 18 shows Lifecycle green and stable. If L1 were banded with a moderate appetite, that row would read red and failing. Both pages can be built from the same data. Only one of them would let a board back the right work, which is the point the book makes about color without direction: a green that is failing underneath is worse than a yellow that is improving.
Take these with you
The templates behind this page
The library tells you what to measure. These are where you write it down and where it goes next. All free.
Identity Metrics Starter
Lift entries from this library into it: owner, source, frequency, target condition, drift signal, audience, and action threshold.
Reporting Dashboard Templates
One tab per altitude, to carry the metrics from the operational floor to the board.
Governance Exception Record
Where a yellow past its dwell time becomes an owned, dated decision.
Adoption Metrics Tracker
More depth on the People & Change metrics.
Drift Visibility Inventory
For finding where your drift signals should come from before you try to measure them.
See the four altitudes worked through on the reporting dashboards page. For a pillar-by-pillar reading of where you are before choosing your first few metrics, try the Predictability Assessment. Terms like drift and predictability are in the glossary.
From the book
The longer treatment
This page is the reference. The argument is in The Modern Identity Operating Model:
- "What a Green Dashboard Can Hide," Chapter 18. Leading and lagging, snapshot and trend, and the two kinds of metric: how you are doing, and what might harm you.
- "Predictability Is the Metric That Matters Most," Chapter 18. Why predictability belongs in front of executives and not only on an operational dashboard.
- "Risk Appetite and Change Appetite Shape the Path," Chapter 11. Where the thresholds on this page get their footing.
- "Risk Acceptance and the Risk Register," Chapter 12. What happens to a red the organization decides to carry.
And the line from Chapter 18 worth keeping over the desk:
Predictability is not a soft measure. It is the visible expression of maturity.
Go deeper in the book
Chapter 18, Metrics That Matter, covers the five measurement domains and how reporting rolls up to the board.
Coming soon: get notified