Friction Is a Governance Problem, Not a User Problem

Last week we talked about privileged access and why it is where identity risk concentrates. Strong controls only work when people actually use them. This is where friction becomes an operating model issue. Friction is not about convenience. Friction is about behavior. When identity processes create unnecessary friction, people find ways around them, and those workarounds weaken the entire operating model.

Friction is not a user problem. It is a governance problem. When authentication, entitlements, lifecycle, and privileged access are inconsistent or confusing, users adapt in ways that create risk.

The Issue

Most organizations treat friction as a training issue. In reality, users resist security because the system behaves unpredictably. Prompts appear at the wrong time. Access requests take too long. Approvals are unclear. Privileged elevation is inconsistent. Exceptions are easier than the intended path. Application teams maintain their own processes because centralized ones feel slow or disconnected. These patterns create shadow identity processes that bypass governance and increase risk.

Friction also appears when leaders do not agree on what belongs in policy, standards, or procedures. Misalignment at the governance layer creates mixed signals, unclear ownership, and stalled decisions. Leadership friction becomes operational friction.

How to Fix It

Treat friction as a signal.

Identify where friction appears across authentication, access requests, approvals, elevation, and onboarding.

Align identity processes with how people work so identity supports workflows instead of interrupting them.

Reduce unnecessary steps by removing redundant approvals and simplifying access paths.

Improve transparency so users understand what is happening and why.

Validate user experience through analytics to see where friction leads to drift.

Align friction with risk. High-risk actions should have friction. Low-risk actions should not.

How to Measure It

• Time to complete access requests
• Time to complete privileged elevation
• Number of exceptions created to bypass friction
• Number of shadow processes identified
• Number of user complaints
• Alignment between friction and risk
• Number of abandoned workflows

How to Audit It

Ask where friction appears in workflows.

Ask how long access requests and approvals take.

Ask how privileged elevation behaves in practice.

Ask how exceptions are created and why.

Ask how users are informed about timelines.

Compare documented workflows to observed behavior in logs and analytics.

Friction is a signal that the operating model needs alignment. When friction is intentional and aligned with risk, identity becomes predictable. When friction is accidental, identity becomes unpredictable.