TL;DR: IAM has been stuck for two decades because manual workflows, hard-coded policies, and integration backlogs have kept identity governance from scaling, while security leaders now want AI that can reason about access, normalize entitlements, and automate remediation, according to Opti. The real shift is not chatbots or anomaly detection, but AI-native identity systems that reduce human review failure and services-heavy onboarding.
At a glance
What this is: NHI Mgmt Group's analysis, drawing on Opti's blog post: Identity governance remains constrained by manual workflows and brittle integrations, and AI-native approaches are being positioned as a way to make access decisions, entitlement understanding, and remediation more scalable.
Why it matters: This matters because IAM teams are being asked to govern more applications, more entitlement complexity, and more review volume without adding proportional manual effort or tolerance for rubber-stamp approvals.
Context
Identity governance becomes fragile when access decisions depend on manual review, hard-coded policy logic, and integration projects that stretch for years. The core problem is not a lack of security intent, but a governance model that no longer matches the scale and variability of modern application estates.
IAM and IGA basics matter here because the gap is not just tooling churn. It is the difference between governance that can keep up with entitlement complexity and governance that only records it after the fact.
Key questions
Q: Should teams use automated access review instead of manual access review?
A: Teams should prioritise automation when the access surface is large, the review cycle is frequent, or the audit evidence must be reproducible. Manual review can still work in narrow environments, but it becomes fragile as complexity grows. The decision should be driven by the required evidence quality, remediation speed, and the tolerance for human error.
Q: How should IAM teams handle applications with inconsistent entitlement models?
A: IAM teams should map each application’s entitlements to a common access model, then normalise entitlement meaning into a shared catalogue of roles, privileges, and effective access. Where applications expose only coarse groups, local permissions, or custom flags, use translation rules, application owners, and periodic certification to keep access reviews and joiner-mover-leaver processes consistent.
Q: What makes an AI-native identity platform different from traditional IGA?
A: An AI-native identity platform is designed to use AI in the identity workflow itself, for example to classify entitlements, detect access anomalies, draft access decisions, and surface toxic combinations with human review. Traditional IGA is usually rule-driven and workflow-centric, so the difference is the ability to reduce integration friction at scale while handling heterogeneous identity data and changing entitlement patterns.
Q: How do teams decide when to automate access remediation?
A: Automate only the cases where the policy is clear, the risk is measurable, and the action is reversible. High-volume, low-dispute access reductions are good candidates. Sensitive systems, regulated data, and ambiguous ownership still need human oversight before privileges are changed.
Technical breakdown
Why entitlement models defeat manual IGA
Every application expresses authorization differently, so a role name alone rarely tells you what a user can actually do. Traditional IGA tools often rely on manual mapping and policy maintenance to normalize those differences, which creates drift, gaps, and long implementation cycles. The challenge is architectural: entitlement semantics are distributed across applications, teams, and time, so a static model cannot stay current without constant human intervention. See the NHI Lifecycle Management Guide.
Practical implication: Treat entitlement normalization as an ongoing governance function, not a one-time integration project.
How automated remediation changes access governance
Automated remediation only works when the system can understand dependencies between entitlements, decide what can be removed safely, and apply the change across connected applications while preserving auditability. That is different from ticket-based workflow automation, which simply moves work from one queue to another. The governance issue is whether the platform can reason over access scope and downstream impact fast enough to make remediation operational rather than ceremonial. Read Top 10 NHI Issues.
Practical implication: Define which access changes can be machine-executed and which still require human approval before you trust automated cleanup.
Why access reviews fail when reviewers lack context
Access reviews become low-value when managers see a long list of entitlements without business context, entitlement meaning, or evidence of risk. In that state, approval becomes the default because the reviewer cannot realistically evaluate each item. AI-assisted review only matters if it can expose what the access means in practice, surface outliers, and reduce the burden of understanding every permission from scratch. See the IAM and IGA Basics.
Practical implication: Rebuild review workflows around meaningful context and risk prioritisation instead of asking reviewers to certify raw entitlement lists.
Threat narrative
Attacker objective: The attacker objective is to retain or obtain excessive access that slips through governance controls and can later be used for abuse, lateral movement, or data exposure.
- Entry occurs through identity sprawl, where application onboarding, entitlement drift, and review fatigue expand the surface that defenders have to govern.
- Privilege escalation follows when excessive permissions remain approved because reviewers cannot see what the entitlements really allow.
- Impact arrives as inappropriate access persists at scale, making governance ineffective and leaving breach-relevant permissions in place longer than intended.
Breaches seen in the wild
- Azure Key Vault Contributor escalation 2024: Datadog found Azure Key Vault Contributor could add itself to access policies and read every secret, key and certificate in a vault.
- Sisense breach 2024: A credential in Sisense's GitLab reportedly opened S3 buckets of customer tokens, passwords and certificates; CISA urged a full reset.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
AI-native IAM is being adopted because the old governance model has hit an operational ceiling. Manual reviews, hard-coded policies, and bespoke integrations do not scale to modern entitlement volume or application diversity. The market shift here is not about novelty for its own sake. It is about replacing governance work that has become structurally unsustainable with systems that can interpret access context at machine speed.
The real governance gap is entitlement semantics, not dashboard visibility. Knowing that access exists is no longer enough when each application defines privilege differently. The hard problem is understanding what those privileges actually enable, and that is why generic workflow automation has failed to move the needle for most IGA programmes.
Access review fatigue has turned certification into a weak control. When managers do not understand the entitlements in front of them, approval becomes the path of least resistance. That means the control fails at the point of decision, not at the point of enforcement. The implication is that identity governance must move from list review to meaning-aware decision support.
Integration backlog governance: The operational bottleneck is no longer policy intent but the inability to onboard applications fast enough to govern them. When a queue stretches into years, the programme is effectively governing only a subset of the environment. Practitioners should treat unfinished onboarding as a governance defect, not a delivery delay.
AI in identity governance is now being judged on whether it reduces human ambiguity, not whether it adds automation theatre. Security teams have little patience left for features that create more review output without improving decision quality. The field will be defined by whether systems can explain access, accelerate remediation, and preserve auditability at the same time.
From our research library:
- Nearly 60% of IT leaders cite restrictive cost and complexity as a weakness of legacy identity governance, according to the 2025 State of Identity Governance Report.
What this signals
Meaning-aware governance will matter more than policy volume. IAM programmes that keep adding rules without improving entitlement semantics will continue to produce review fatigue and weak certification outcomes. The next competitive gap will be between teams that can explain access decisions and teams that can only record them.
Identity governance teams should expect pressure to prove that onboarding, review, and remediation reduce real decision time, not just increase workflow throughput. If AI cannot shorten the path from entitlement discovery to trustworthy action, it will be treated as another layer of administrative overhead rather than a control improvement.
For practitioners
- Define where AI can make access decisions Separate low-risk access decisions that can be machine-assisted from high-risk cases that still need human review. This prevents AI from being treated as a universal shortcut and keeps accountability clear.
- Map entitlement meaning before automating reviews Document what common roles and permissions actually enable in each major application class. Without that layer, review output will stay noisy and reviewers will keep defaulting to approval.
- Set remediation boundaries for identity changes Specify which revocations, resets, and entitlement removals can be executed automatically and which must stop for approval. This keeps automated cleanup auditable and avoids unsafe changes across dependent applications.
- Treat onboarding backlog as risk exposure Track ungoverned applications as part of security risk reporting, not just implementation work. A large queue means access decisions are being made outside formal governance for too long.
Key takeaways
- Identity governance struggles when access meaning is opaque, integrations are slow, and review workflows still depend on human guesswork.
- The operational problem is not abstract AI hype. It is the scale mismatch between modern application estates and governance processes built for a much smaller environment.
- Practitioners should focus on entitlement context, review quality, and bounded automation if they want AI to improve governance rather than add another layer of noise.
Related NHI Mgmt Group resources: Top 10 NHI Issues · NHI Lifecycle Management Guide · IAM and IGA Basics · Top 10 Agentic AI Identity Issues
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 addresses the attack and risk surface, while NIST CSF 2.0 and NIST AI RMF set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-05 — Overprivileged NHI | The article centres on excessive access and review failures that leave entitlements broader than needed. |
| NHI-08 — Environment Isolation | Application onboarding and entitlement mapping depend on separating governance context across systems. | |
| Recommendation — Reduce standing access by tightening entitlement scope and reviewing where governance keeps approving excess privilege. Separate access models by application context so governance does not blur distinct entitlement meanings. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | The article is fundamentally about governing permissions, certifications, and entitlement decisions at scale. |
| GV.RM-01 — Risk Management Strategy | The piece argues that identity governance must be treated as an enterprise risk issue, not a workflow problem. | |
| Recommendation — Review permission assignment logic so entitlements are understandable, auditable, and risk-based. Align IAM investment to explicit risk reduction goals instead of treating governance as administrative throughput. | ||
| NIST AI RMF | GOVERN — AI Governance and Accountability | The article discusses how AI should be governed when it influences identity decisions and remediation. |
| Recommendation — Define accountability, oversight, and decision boundaries before deploying AI into identity workflows. | ||
Key terms
- Identity Governance: Identity governance is the set of controls that defines who approves access, who owns it, how it is reviewed, and when it is removed. In practice, it turns identity management from a deployment task into a durable control system that can withstand audits, organisational change, and operational growth.
- Entitlement: An entitlement is the permission set that defines what a non-human identity can do after it authenticates. It is usually expressed through roles, policies or access assignments, and unmanaged entitlements are a common reason machine identities become over-privileged over time.
- Access Review: A formal process for confirming whether access is still needed and justified. In IAM programs, the review becomes an evidence-bearing control when decisions are recorded, scoped correctly, and traceable to the right reviewer, application owner, or auditor.
- Automated Remediation: A policy-driven process that executes predefined fixes for known security issues without waiting for manual ticket closure. In SaaS security, it is the practical bridge between finding a risky share or integration and actually reducing exposure at scale.
Deepen your knowledge
NHI governance, agentic AI identity, and machine identity security are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.
Published by the NHIMG editorial team on November 4, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org