When Access Fails Quietly : A Privilege Maturity and Control Drift Framework for Governance Risk in Open-Source ERP Systems

Abstract

Open-source ERP systems such as ERPNext provide flexibility for resource-constrained enterprises but often lack mature governance controls. This paper introduces a driftaware framework for access governance, centered on three novel constructs: the Privilege Maturity Index (PMI), Control Drift Taxonomy (CDT), and Access Governance Risk Score (AGRS). Validated through a longitudinal ERPNext case study in a Gulfbased firm, the model reveals how silent erosion of access discipline undermines governance integrity. Findings emphasize that systemic risks stem less from external breaches and more from organizational drift. In addition to highlighting an original framework, we show how the model naturally aligns with emerging guidance such as NIST CSF 2.0 and zero-trust architectures, ensuring both originality and applicability in modern governance contexts.