AI-driven access recommendations expose the limits of certification

At a glance

What this is: This is a SailPoint blog arguing that AI-guided access recommendations can reduce certification fatigue by surfacing approve or revoke guidance from peer-group and identity data.

Why it matters: It matters because IAM and IGA teams need review processes that support precise revocation decisions, not broad approvals that leave overprovisioning and noncompliance in place.

Context

Access certification is supposed to identify and remove unnecessary access, but it often breaks down when reviewers lack enough context to make confident decisions. In practice, that leads to blanket approvals, lingering excess access, and slower remediation across human identity programmes.

This article focuses on how AI-assisted recommendations change the reviewer experience in IGA. The underlying governance issue is not whether people can be trained to review more carefully, but whether the review model gives them the right signals to decide what should be revoked.

Key questions

Q: How should teams reduce certification fatigue without weakening access governance?

A: Use risk-based review queues that separate routine access from sensitive entitlements, so managers are not asked to assess every item equally. Certification works best when reviewers have context, clear policy boundaries, and a short list of exceptions that actually deserve human judgment.

Q: Why do access reviews fail to remove unnecessary permissions?

A: They fail when reviewers see a list of entitlements but not enough context to judge whether the access is still needed. Without usage data, role information, and policy thresholds, certification becomes an approval exercise instead of a removal mechanism. The fix is to review actual use, not just stored permissions.

Q: What are the signs that an access certification campaign is failing in practice?

A: A campaign is failing when reviewers are working from stale data, the review window is too vague, or the process becomes so frequent that people stop giving it proper attention. Other warning signs include unclear objectives, inconsistent ownership, and responses that cannot be acted on because the evidence is incomplete. Those conditions make the results misleading instead of usable.

Q: What should IAM teams prioritise first in access certification design?

A: Start by identifying which access is birthright, which is routine, and which is genuinely sensitive. Once that split is clear, reviewers can focus on the access decisions where human judgment changes security outcomes.

Technical breakdown

How peer-group analysis shapes certification decisions

Peer-group analysis compares an identity against users with similar attributes such as role, department, and location. In access certification, that context can help reviewers distinguish expected access from outliers that deserve scrutiny. The mechanism is not autonomous decision-making. It is decision support that turns an entitlement list into a more meaningful review queue, which can make revocation decisions more precise when the governance process is already in place.

Practical implication: Use peer-group context to narrow review scope to the access that genuinely needs human judgment.

Why birthright access is often excluded from review queues

Birthright access is the baseline access users receive simply because they are employees or part of a standard population. When that access is mixed into certification campaigns, reviewers spend time confirming obvious items instead of evaluating higher-risk entitlements. Excluding these low-value items reduces noise and helps reviewers focus on access that is more likely to create compliance or privilege risk. The technical value is not fewer controls, but better sequencing of review effort.

Practical implication: Separate baseline entitlements from exception entitlements before certification starts.

Auto-approval changes the economics of low-risk access

Auto-approving low-risk access shifts the review model from exhaustive checking to risk-weighted attention. That works only when the policy model can distinguish routine access from access that affects sensitive applications or elevated functions. The architecture still depends on governance rules, identity attributes, and application knowledge, but it reduces manual effort where human review adds little value. In IGA terms, this is a triage model for certification rather than a replacement for it.

Practical implication: Reserve manual review for access where revocation mistakes would create real operational or compliance impact.

NHI Mgmt Group analysis

Certification fatigue is a governance problem, not just a user-experience problem. When reviewers see long entitlement lists without context, they rationally default to approval because the cost of a false revoke feels higher than the cost of inaction. That creates overprovisioning and weakens the integrity of access recertification. The practical lesson is that certification quality depends on decision quality, not review volume.

Context-rich review is now the real control surface. Peer groups, role attributes, and location data do not replace governance judgement, but they make revocation decisions materially more defensible. This is where IGA programmes separate signal from noise: not by increasing the number of reviews, but by improving the quality of the evidence behind them. The result is a more credible certification cycle, especially for large entitlement populations.

Access reviews work best when they are selective, not comprehensive. The strongest certification programmes do not ask business managers to question every entitlement equally. They use governance logic to suppress obvious low-risk items and direct attention toward anomalous or sensitive access. That changes certification from a compliance chore into a targeted control, which is how recertification becomes operationally useful.

More revocation is a better metric than more approval velocity. The article’s core insight is that identity governance should optimise for accurate removals, not just faster completion. If a review process speeds up while still producing rubber-stamp outcomes, the programme has only compressed its failure mode. Practitioners should judge certification quality by the specificity of revocations and the reduction of unnecessary access over time.

AI-assisted certification should be evaluated as a decision-augmentation layer inside IGA. It changes how humans prioritise work, but it does not change the underlying requirement for review ownership, policy definitions, and exception handling. That means the governance question is not whether AI can decide for reviewers, but whether it can help them make better revocation choices at scale. The implication for practitioners is to treat recommendation quality as a control design issue.

From our research library:

• 91.6% of secrets remain valid five days after the targeted organisation is notified, showing a critical gap in remediation procedures, according to the Ultimate Guide to NHIs.
• 64% of valid secrets leaked in 2022 are still valid and exploitable today, proving that detection alone is not enough without automated revocation, according to the State of Secrets Sprawl 2026.
• Read next: Access Reviews and Certification Guide

What this signals

Certification quality depends on decision context, not just review cadence. Programmes that treat every entitlement as equally reviewable create fatigue and invite rubber-stamp approvals. The better model is to reduce the review surface before the campaign starts, then reserve human attention for the access that actually changes risk.

Access recommendations are best understood as a triage mechanism inside IGA. They do not remove the need for governance ownership, but they help reviewers spend time where a revoke decision matters. That shift is especially important when identity inventories are large and the cost of noisy certification is continued overprovisioning.

For practitioners

• Define review tiers by access risk Separate birthright access, routine low-risk entitlements, and high-risk privileges before recertification so reviewers are not forced to treat every item as equally important.
• Use identity attributes to improve reviewer context Feed role, department, and location into certification workflows so reviewers can compare each entitlement against a meaningful peer group before deciding.
• Suppress obvious low-risk items from certification queues Remove entitlements that do not add governance value from manual review lists so reviewer effort stays concentrated on exceptions and elevated access.
• Measure certification quality by revocation accuracy Track whether reviews are producing specific removals of unnecessary access rather than generic approvals that leave privilege creep untouched.

Key takeaways

• AI-driven recommendations improve certification only when they help reviewers make narrower, more defensible revoke decisions.
• Without context, access recertification tends to reward speed over accuracy and leaves excessive access in place.
• The operational goal is not more approvals, but better removal of unnecessary entitlements.

Key terms

• Access Certification: Access certification is the periodic review of whether an identity still needs its current entitlements. For NHIs, certification is only reliable when reviewers know the identity's owner, purpose, and expiry, otherwise stale machine access can persist long after the original use case has ended.
• Birthright Access: The baseline set of entitlements that a user should receive by default because of role, department, or another stable attribute. It is a governance construct, not a blanket permission model. The control challenge is proving that the baseline stays current as jobs, applications, and ownership change.
• Privilege Creep: Privilege creep is the gradual accumulation of access rights beyond what an identity actually needs. It usually happens when permissions are added for convenience and never removed. For NHIs, privilege creep expands blast radius and makes old credentials far more dangerous than their original purpose suggests.
• Peer-group analysis: A method of comparing a user or account to others with similar roles, functions, or access patterns. It helps identity teams identify outliers in permissions or activity, but only works when the comparison group reflects real operational similarities.

Deepen your knowledge

NHI governance, identity lifecycle management, and secrets management are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM or identity governance programme, it is worth exploring.