AI adoption as mandate: what Dialpad’s model means for IAM

At a glance

What this is: NHI Mgmt Group's analysis, drawing on WorkOS's blog post: Dialpad is treating AI adoption as an operating requirement across multiple functions, not a discretionary productivity tool, while acknowledging that the underlying models remain non-deterministic.

Why it matters: IAM, IGA, PAM, and identity architects need to see how mandatory AI use changes governance when humans, workflows, and AI-assisted systems all participate in execution.

Context

AI adoption is no longer just a tooling decision when an organisation requires employees to use it in core work. In this interview, the governance problem is not whether AI exists in the stack, but how identity controls behave when humans are expected to work through AI-assisted processes every day.

That matters for identity programmes because the control plane was built around stable users, predictable approvals, and reviewable actions. Once AI becomes part of how work is produced, the identity model has to account for non-deterministic output, shared human-plus-machine execution, and accountability that is no longer purely human.

Dialpad is a useful case because the article describes AI adoption as policy across several functions rather than a narrow pilot. That makes it representative of the pressure many IAM teams will face as AI moves from experimentation into mandatory operating practice.

Key questions

Q: How should organisations govern AI-assisted work in engineering and operations?

A: Treat AI-assisted work as an identity and accountability problem, not just a productivity upgrade. Define which actions the AI may influence, which outputs require human verification, and which systems or data sources sit behind the workflow. Then align review, logging, and approval rules to the actual runtime path rather than the job title alone.

Q: Why do AI agents make non-human identity governance harder?

A: AI agents make governance harder because they can request tools, act autonomously, and change behaviour across sessions while still relying on machine credentials. That increases the number of access paths security teams must supervise. The result is a stronger need for task-scoped access, explicit ownership, and continuous monitoring of what the agent can reach.

Q: What breaks when AI-generated content is used in performance reviews or customer workflows?

A: The review process can fail if humans treat AI output as authoritative without enough scrutiny. In that case, the organisation is no longer checking a person’s work, it is ratifying machine-generated content. That creates accountability gaps, weak evidence trails, and a false sense of control over decisions that affect people.

Q: What is the difference between user access and approval authority in AI-assisted processes?

A: User access lets someone operate the tool, while approval authority lets them accept, publish, or act on the AI output. Those are not the same control. In mature governance, a user may be allowed to draft with AI but still need separate permission and oversight to commit the result into a business process.

Technical breakdown

Mandated AI use changes the identity boundary around work

When AI becomes mandatory, the relevant question is no longer whether a user logged in with the right human credentials. The identity boundary shifts to a workflow where a person, an AI assistant, and an application each influence the resulting action. That complicates access governance because the action may be initiated by a human, drafted by a model, and executed through a separate business system. The control problem is not just authentication. It is attribution, approval, and evidence of who or what shaped the final decision. In identity terms, the programme has to govern composite execution paths rather than isolated user sessions.

Practical implication: map where human approvals end and AI-assisted execution begins, then assign accountability to each step in the workflow.

Non-deterministic output is a governance problem, not only a model problem

Peterson’s point that large language models remain non-deterministic matters to IAM because non-determinism breaks assumptions behind repeatability and certification. Access reviews assume that a role or process behaves consistently enough to be assessed against an expected pattern. AI-assisted work can vary from one run to the next, even when the same person and the same prompt are involved. That means governance cannot rely only on static entitlement checks. The identity layer needs to distinguish between permission to use the tool, permission to act on the output, and permission to let the output trigger downstream business action. Those are different controls.

Practical implication: separate tool access from downstream action rights so AI output cannot automatically become authoritative execution.

Human verification remains necessary when AI drafts or synthesises decisions

The article notes that Dialpad uses AI for performance reviews while humans verify the output. That pattern is common: AI handles drafting, summarisation, or first-pass analysis, and a human retains responsibility for final acceptance. The IAM issue is that verification is often treated as a soft process, when in practice it is a critical control point. If the reviewer can rubber-stamp AI-generated content without enough context, the control fails. For identity governance, this creates a new class of approval: not just who can access a system, but who is authorised to ratify AI-assisted decisions and under what evidence standard.

Practical implication: require explicit human ratification steps for AI-assisted decisions that affect people, money, or sensitive operational changes.

NHI Mgmt Group analysis

AI mandate turns governance from adoption management into execution governance: Once an organisation requires AI use across functions, the identity problem is no longer optional adoption. The programme has to govern how people, systems, and AI outputs combine inside routine work. That is a different control challenge from granting software access, because the action path itself becomes variable. Practitioners should treat mandatory AI use as a workflow governance issue that sits alongside IAM, not beneath it.

Non-determinism collapses the assumption that reviewable work remains stable long enough for traditional controls: Access review processes were built for permissions and roles that persist long enough to be certified. AI-assisted work can change from task to task even when the same user is involved. That means the decisive question is not only who had access, but whether the work product can be trusted as a stable artefact for approval and audit. Identity teams should assume variability is now part of the control environment.

AI-assisted performance processes create a new accountability layer: When AI drafts performance reviews, summaries, or customer interactions, the organisation is no longer governing a human action alone. It is governing the ratification of machine-generated content by a human reviewer. That makes evidence quality, reviewer authority, and escalation paths part of the identity model. Practitioners should define who can authorise AI-assisted decisions and what level of human confirmation is required before downstream action.

Composite identity governance: The article points toward a model where the meaningful unit is not the user or the tool, but the human-plus-machine workflow. That framing matters because conventional IAM often separates access, approval, and execution into clean layers. In AI-assisted operations those layers blur, so the governance boundary has to move upward to the workflow itself. Practitioners should redesign controls around composite action paths, not isolated identities.

Category pressure will shift toward assurance over behaviour, not just access: As more organisations mandate AI use, the market will move from feature adoption to operational assurance. Teams will need to know which tasks may be AI-assisted, which outputs require human ratification, and which actions must never be delegated to model-generated content alone. That makes identity governance a design requirement for AI operating models rather than a downstream compliance exercise.

From our research library:

• Organisations that describe themselves as confident in their AI deployment actually experience a 72% security incident rate, compared to 33% for those who remain cautious, according to the 2026 Infrastructure Identity Survey.
• Only 13% of organisations feel extremely prepared for the reality of agentic AI despite the majority racing toward autonomous adoption, according to the 2026 Infrastructure Identity Survey.
• Read next: Cloud Workload Identity Guide

What this signals

Composite identity governance: AI-first operating models push IAM teams toward governing the workflow as the real unit of control. When human intent, model output, and system execution all influence the same action, the programme has to define which step carries accountability and which step merely assists.

The practical test is whether the organisation can still explain who approved what, on what basis, and through which system path. That becomes harder when AI is mandatory rather than optional, because the control boundary moves from login to output ratification to downstream execution.

For practitioners

• Define AI-assisted workflow boundaries Document which business processes may use AI, where human approval remains mandatory, and which downstream systems can never accept model-generated output without review.
• Separate tool access from execution rights Grant users permission to use AI tools without automatically granting authority to commit the resulting output into systems of record, customer workflows, or employment decisions.
• Create reviewer accountability rules Assign named human owners for AI-assisted outputs in performance management, customer service, and engineering so verification is a controlled step rather than an informal habit.
• Test non-deterministic workflows before mandate rollout Run controlled exercises that repeat the same AI-assisted task multiple times to see where outputs diverge, then decide which steps need tighter approval or evidence requirements.

Key takeaways

• AI adoption becomes an identity governance issue once organisations require it as part of normal work rather than treating it as an optional assistant.
• Non-deterministic model behaviour weakens control assumptions built around stable roles, repeatable approvals, and reviewable artefacts.
• IAM teams should define where AI can assist, where humans must ratify, and where model output is never allowed to become authoritative on its own.

Key terms

• Composite Identity: An identity made up of more than one control relationship, typically a human owner, an AI agent, and the credentials or services the agent uses. It matters because accountability, access scope, and runtime behaviour all have to be governed together, not as separate problems.
• Non-deterministic output: Non-deterministic output means the same prompt or input can produce different responses across runs. In security terms, that makes one-off validation weak because the risk lies in the range of behaviours the system may exhibit, not a single predictable result.
• Human Ratification: A control step where a person formally accepts, signs off on, or publishes AI-assisted work before it affects a business process. It is stronger than passive oversight because the human owner is accountable for the final decision and must review the evidence, not just the summary.
• AI-assisted workflow: A workflow in which a person uses AI to draft, classify, summarise, or recommend actions as part of normal work. The human may remain accountable, but the machine changes how decisions are formed and how much of the output is generated before review.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity security are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.