TL;DR: Opal Security says non-human and agent identities already outnumber people, and the roughly 100-hour access review cycle cannot keep pace, so manual governance is breaking at machine scale. Human accountability still matters, but review processes now need machine-speed execution and auditable decisions.
At a glance
What this is: This is a product analysis of AI-guided access reviews, with the core finding that human-scale review cycles no longer keep pace with machine-scale identity estates.
Why it matters: It matters because IAM, IGA, PAM, and NHI teams now have to govern access that changes faster than quarterly or even monthly review cadences can realistically certify.
👉 Read Opal Security's analysis of AI-guided access reviews for machine-scale governance
Context
Access review programmes are built on an assumption that access remains stable long enough for a human reviewer to inspect it, decide on it, and certify it. That assumption weakens when non-human and agent identities outnumber people and access changes continuously across systems.
In practical IAM terms, the problem is not only review volume. It is that machine-scale identity estates create more grants, more context, and more decision points than human-paced governance workflows can absorb without automation, evidence retention, and clear accountability.
The article frames AI-guided access reviews as a response to that governance gap, with humans still signing off on the decisions that matter. That is a typical pressure point for modern access governance programmes, not an edge case.
Key questions
Q: What breaks when access reviews are only run on a fixed schedule?
A: Fixed-cycle reviews encourage repetition, not judgment. Reviewers see the same access over and over, approve it because it looks familiar, and miss the changes that actually matter. Risk-based reviews tied to role change, privilege growth, and inactivity are far more effective than calendar compliance.
Q: Why do AI-guided access reviews still need a human sign-off?
A: Because recommendation quality and accountability are different controls. AI can group entitlements, surface evidence, and reduce reviewer workload, but a human sign-off preserves responsibility for the certification decision. That boundary matters in audits, exceptions, and cases where business context cannot be inferred from the access graph alone.
Q: How do teams know if automated access reviews are actually working?
A: Automated reviews are working when exception rates fall, reviewer overrides become rare, and access decisions are grounded in clean role definitions rather than ad hoc exceptions. If certifications keep surfacing the same noisy entitlements, the problem is usually role design, not reviewer effort. Effective automation should reduce ambiguity, not scale it.
Q: How should IAM teams govern human, non-human, and AI identities together?
A: Start by separating the identity types in policy, ownership, and review cadence, then define where controls can be shared and where they must remain distinct. Human users, service identities, and AI systems do not fail in the same way, so the governance model has to preserve that difference while still producing one audit trail.
How it works in practice
Why human-paced access reviews break at machine scale
Traditional access reviews assume a reviewer can inspect a finite set of grants, compare them against business context, and certify them within a reasonable campaign window. That model works when identities and entitlements change slowly. It fails when non-human and agent identities produce far more access relationships, because the review workload becomes combinatorial rather than linear. The issue is not only speed but decision quality: reviewers lose context, groupings are inconsistent, and low-risk grants consume the same attention as high-risk ones.
Practical implication: treat review throughput as a governance constraint, not an operations inconvenience.
How AI-guided access reviews change the certification workflow
AI-guided reviews shift the workflow from manual enumeration to evidence-assisted prioritisation. The system groups low-risk access, surfaces context for each grant, and keeps a human sign-off at the point of certification. In other words, the human is not removed from the control loop. The human is moved to the final decision layer, while the machine handles classification, grouping, and recommendation. That changes the architecture of governance from reviewer-driven to decision-support-driven.
Practical implication: separate recommendation generation from certification authority so automation accelerates review without owning the decision.
Why transparency and auditability matter more when AI assists governance
AI-assisted governance only works when every recommendation and decision can be traced back to the underlying access graph, policy logic, and audit trail. Without that lineage, machine-made suggestions become hard to defend in an audit or after a security incident. The article’s emphasis on transparency is therefore not a product feature detail. It is the control plane requirement that makes assisted governance acceptable in regulated environments and large enterprise review programmes.
Practical implication: require auditable decision history before allowing AI to influence access certification.
NHI Mgmt Group analysis
Access review cadence was designed for stable human identity estates. That assumption weakens when non-human and agent identities dominate the access graph and change faster than a campaign window can absorb. The implication is not merely more automation. It is that certification itself must be rethought as a machine-paced governance process with human accountability preserved at the final decision point.
Machine-scale identity estates turn access review from a periodic control into a continuous governance problem. When grants proliferate faster than reviewers can inspect them, the control’s effectiveness depends less on reviewer effort and more on how well the programme pre-groups risk, preserves context, and maintains evidence. Practitioners should stop treating review completion as proof of governance maturity.
AI-guided governance is only defensible when the human is still accountable and the machine is only advisory. Opal Security’s framing shows why the most important design boundary is not speed, but authority. If a system can recommend, group, and track access but a human signs off on certification, the model can scale without collapsing accountability.
Ephemeral access review gap: The strongest signal here is that many governance cycles still assume access persists long enough to be reviewed after the fact. That assumption fails when access is short-lived, time-bound, or generated at machine speed. Practitioners should move review logic closer to issuance, not rely on retrospective certification alone.
Human-scale IAM is no longer the default operating model. The identity estate now includes service accounts, workload credentials, and AI agents that do not fit legacy review pacing. That means access governance teams must align policy, evidence, and reviewer workflow to the actual tempo of identity creation and change, not the calendar.
From our research library:
- Over 70% of organisations lack automated access risk analysis, user access reviews and provisioning and deprovisioning, according to Pathlock's 2025 Digital Transformation and Access Risk Report.
- Read next: Access Reviews and Certification Guide
What this signals
Access governance has become a throughput problem as much as a policy problem. When review cycles lag behind identity churn, the bottleneck is no longer reviewer intent but reviewer capacity. Programmes should measure whether certification cadence is aligned to the rate at which access actually changes, especially for service accounts and AI agents.
Decision support will matter more than campaign mechanics. The next generation of IAM and IGA controls will be judged on whether they can prioritise, explain, and preserve the rationale for each access decision. That shifts value away from bulk review execution and toward defensible, traceable certification logic.
For practitioners
- Map access review latency against identity churn Measure how long certification cycles take relative to how quickly entitlements are created, modified, and removed across human, service, and agent identities.
- Group low-risk access before reviewers see it Use risk-based clustering so reviewers can clear obvious grants quickly and focus on access that changes blast radius or ownership.
- Preserve a complete audit trail for every recommendation Record the access graph snapshot, grouping logic, reviewer decision, and timestamp so each certification remains defensible after the campaign closes.
- Shift governance closer to issuance for fast-changing identities For time-bound and machine-generated access, make the issuance decision carry the control weight instead of relying on retrospective review alone.
Key takeaways
- Human-scale access reviews are no longer a reliable control model when identity churn exceeds reviewer capacity.
- AI-guided review can reduce effort, but only if it preserves accountable human certification and audit evidence.
- The real governance shift is from periodic review campaigns to faster, evidence-rich decision support closer to issuance.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 addresses the attack and risk surface, while NIST SP 800-53 Rev 5 and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-01 — Improper Offboarding | The article centres on access governance across identities that outgrow manual review cadence. |
| NHI-05 — Overprivileged NHI | Review automation is meant to find access that has accumulated beyond current need. | |
| Recommendation — Use NHI-01 to ensure short-lived and removed access is certifiably offboarded from review scope. Apply NHI-05 to prioritise grants whose current privilege exceeds operational need. | ||
| NIST SP 800-53 Rev 5 | AC-6 — Least Privilege | Access reviews exist to enforce least privilege across changing entitlements. |
| Recommendation — Use AC-6 to recertify only the access required for each role, service, or agent. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | The article is directly about governing permissions and certifications at scale. |
| Recommendation — Apply PR.AA-05 to keep entitlement decisions current as identities and access change. | ||
Key terms
- Access Review Cadence: The schedule at which an organisation rechecks whether access is still justified. In GDPR programmes, cadence is not administrative detail, because access can become non-compliant as soon as business need changes. For NHI and delegated access, cadence must be tight enough to catch drift before it becomes exposure.
- Decision Governance: Decision governance is the practice of governing the authorization decision itself rather than only the identity record or entitlement list. It focuses on the subject, action, resource, and context that produced the result, which is especially important when agents and service accounts can act dynamically at runtime.
- Identity Churn: Identity churn is the rapid creation, rotation, and disposal of identities faster than defenders can reliably attribute or retire them. In telecom and NHI contexts, it creates visibility gaps, weakens lifecycle control, and turns one-off accounts or numbers into scalable abuse infrastructure.
- Audit-Ready Compliance: Audit-ready compliance means maintaining evidence, controls, and decision records in a form that can be reviewed without last-minute reconstruction. For third-party risk, this includes clear due diligence, remediation tracking, and governance documentation that shows how vendor risks were assessed, approved, and monitored over time.
What's in the full announcement
Opal Security's full product post covers the operational detail this post intentionally leaves for the source:
- How Paladin groups access grants and surfaces supporting evidence during certification
- The mechanics of query-based scoping and automatic reviewer assignment
- The workflow for progress tracking, reminders, and decision history across campaigns
- How AI-assisted remediation and access requests share the same access graph and audit trail
Deepen your knowledge
NHI governance, agentic AI identity, and machine identity security are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.
Published by the NHIMG editorial team on June 20, 2026.
Updated on October 7, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org