Measurement

A dashboard can be green while the operating model is drifting.

The metric shows what was easy to count. The system shows what is actually happening. They are not always the same story.

I have watched a dashboard turn green while every IAM person in the room knew the environment was getting worse. The provisioning numbers improved. The model was drifting under all of it.

Implementation is easy to overstate. A tool is deployed. A workflow exists. A control is documented. The dashboard turns green. None of that answers the real question.

Is the operating model actually working?

That answer does not come from project status. It comes from operational evidence. Implementation is complete when identity behaves predictably under change, over time.

Every post in this series ended with a Measure section. The list is long. The harder question is whether it tells the truth.

A measurement model that holds surfaces drift before incident, distinguishes activity from health, and changes decisions. It also has to speak to three audiences.

Executives need trend direction and risk reduction. Top metrics: phishing-resistant authentication coverage, privileged access trend, AI agent governance posture.

Operational teams need action-ready signal. Top metrics: mean time to deprovision, orphaned account rate, provisioning latency.

Governance bodies need standards integrity. Top metrics: access review completion with meaningful remediation, exception trend, standards adherence.

The same data does not need to be presented the same way to everyone. Reporting becomes useful when it is role-aware.

Standardizing how these metrics are collected and rolled up across hundreds of apps is its own discipline. Without it, audience views report different versions of the truth.

Start by getting clear on:

• Which metrics tell you the model is holding, not just moving
• Where activity is being mistaken for health
• Whether the same data tells the right story to each audience
• Which metrics actually changed behavior in six months

Measure the measurement model:

• Predictability over time, not snapshot status
• Drift surfaced before incident, not after
• Activity counts separated from health signals
• Decisions changing because of what the metrics show

A measurement model that produces only dashboards is reporting. One that changes behavior is operating. The model is real when measurement shows it holding, not just moving.

❓ Where does your dashboard look green while you know something is drifting?