Identity drift is a security state where an account, service principal, API token, or agent identity gains more access than its intended role requires. This can happen gradually through role changes, inherited permissions, delegated access, stale credentials, or overly broad group membership. The identity still looks legitimate, but its real authority no longer matches its original purpose.
In cyber security, identity drift matters because attackers often abuse excess privilege instead of breaking authentication outright. If a compromised account has drifted into a more powerful role, the attacker can move faster, reach more systems, and cause greater damage. Defenders look for drift by comparing assigned permissions with actual behavior, auditing delegation chains, and removing unused or excessive access. In AI and automation environments, runtime monitoring and scoped containment help catch identities that begin acting outside their expected mission.