Explainable AI in identity governance: why 99% accuracy falls short

At a glance

What this is: This is an independent analysis of explainable AI in identity governance, with the key finding that 99% accuracy is still insufficient when the remaining error can create a compliance or privilege risk.

Why it matters: It matters because IAM, IGA, and PAM teams need AI-assisted workflows that remain auditable, deterministic, and human-governed across role reviews, recertifications, and access decisions.

By the numbers:

• In pilot deployments with mid-sized enterprises, NICO reduced recertification review time by 60-70% by surfacing high-risk assignments first.

👉 Read Nexis's analysis of explainable AI in identity governance

Context

Explainable AI in identity governance is the use of AI that shows its reasoning before a recommendation is accepted. In IAM, that distinction matters because access decisions, role design, and recertification outcomes have to be traceable, repeatable, and defensible, not just statistically accurate.

The governance gap is not that AI cannot assist identity work. The gap is that black-box outputs do not satisfy the controls practitioners need when access rights affect segregation of duties, compliance evidence, and privilege escalation risk. For teams building AI into IAM, the question is whether the system can explain itself well enough to preserve control. See the Ultimate Guide to NHIs for the broader governance baseline.

Key questions

Q: How should security teams use AI in identity governance without losing control?

A: Security teams should use AI to prioritise reviews, surface anomalies, and draft governance content, while keeping approvals, exceptions, and certification decisions with accountable humans. The key test is whether the AI can explain its reasoning clearly enough for an auditor or reviewer to follow the logic. If not, it should not drive control decisions.

Q: Why is 99% accurate AI still not enough for IAM decisions?

A: Because IAM errors are not evenly distributed. The small percentage of wrong recommendations can create the exact cases that matter most, such as privilege escalation, segregation of duties conflicts, or unsupported access in a compliance review. In identity governance, a high average score does not replace deterministic, reviewable reasoning for the edge cases.

Q: What do organisations get wrong about explainable AI in IGA?

A: They often treat explainability as a nice-to-have explanation layer rather than part of the control. In practice, explainability is what allows a reviewer to challenge a recommendation, preserve auditability, and validate that the model is not hiding stale or biased data. Without that, AI only compresses uncertainty into a faster workflow.

Q: Should IAM platforms expose governance data to copilots and AI agents?

A: Yes, but only with explicit interface governance. If copilot or agent access is allowed, the platform must limit scope, log every query, and protect sensitive entitlement and policy data like any other control surface. Identity data is valuable precisely because it is reusable, so reuse has to be governed.

Technical breakdown

Why probabilistic AI creates a governance problem in IAM

Probabilistic models are useful for summarisation, pattern detection, and recommendation ranking, but they are not inherently suitable for governance decisions unless the reasoning is visible. IAM requires consistent outputs because recertification, role mining, and segregation of duties checks are control activities, not suggestions. A model that cannot show which data patterns or rules drove its output creates an evidence problem even when it is usually correct. In practice, the issue is not only false positives or false negatives. It is whether the decision path can be reviewed later by auditors, owners, and security teams.

Practical implication: require AI-assisted IAM workflows to expose rationale, inputs, and decision history before they are used in certification or access approvals.

Explainable AI in access reviews and role management

In identity governance, explainability turns AI from a hidden decision engine into a review aid. The useful pattern is not autonomous approval, but prioritisation: highlighting changed employees, unusual entitlements, and roles that no longer match observed usage. That makes the workflow faster without removing human accountability. The same model applies to role management, where AI can flag inconsistencies between role names, descriptions, and actual permissions. This is especially important because role data often decays slowly and silently, which means small errors accumulate into governance debt.

Practical implication: use explainable AI to triage recertification and role review queues, not to bypass approval steps.

How MCP changes identity governance data exposure

Model Context Protocol gives other systems a standard way to query identity governance data and functions without custom integrations. That is operationally attractive because compliance tools, copilots, and AI agents can consume role assignments, SoD rules, and governance documentation more easily. The technical risk is that identity governance becomes a shared intelligence layer, so access to the data needs its own controls. Exposing identity content through MCP does not remove governance requirements. It increases the number of consumers that can ask for sensitive entitlement and policy data.

Practical implication: treat MCP exposure as a new identity data interface that needs explicit authorization, logging, and scope limits.

NHI Mgmt Group analysis

Explainability is a control requirement, not a usability feature. IAM decisions affect segregation of duties, access recertification, and compliance evidence, so a model that cannot justify its recommendation is missing part of the control itself. The operational question is not whether the AI is often right, but whether its logic is reviewable when the 1% outlier matters. Practitioners should treat reasoning visibility as a governance prerequisite, not a design preference.

AI-assisted identity governance works best when it narrows attention, not authority. The strongest use case is to surface changed records, anomalous entitlements, and inconsistent documentation so humans spend time on the highest-risk items. That preserves deterministic decision-making while reducing review fatigue. The implication for practitioners is to measure whether AI is improving review quality, not merely reducing cycle time.

Data quality and governance quality are the same problem in different forms. If role descriptions, entitlement mappings, and attribute records are stale, AI will amplify that inconsistency rather than fix it. Explainability helps because it makes the mismatch visible inside the workflow instead of hiding it in a separate cleanup project. Teams should treat governance review and data correction as one operational loop.

MCP turns identity governance into an enterprise control plane, which raises the bar for interface governance. Once role and policy data are queryable by copilots and agents, identity becomes a shared dependency across compliance, ITSM, and security tooling. That expands the value of the data, but it also expands the blast radius of poor access design. Practitioners should govern the interface, not just the identity store.

Trust in AI-powered IAM depends on preserving human decision ownership. The editorial line is straightforward: AI can recommend, rank, and explain, but it should not become the authority that certifies access on its own. The discipline of identity governance still rests on accountable approvers, auditable rules, and defensible exceptions. Teams should evaluate AI by whether it strengthens that chain of accountability.

From our research:

• 1.5 out of 10 organisations are highly confident in their ability to secure NHIs, compared to nearly 1 in 4 for securing human identities, according to The State of Non-Human Identity Security.
• 85% of organisations lack full visibility into third-party vendors connected via OAuth apps, with 38% reporting no or low visibility and 47% reporting only partial visibility.
• That visibility problem is why practitioners should also review Ultimate Guide to NHIs , Lifecycle Processes for Managing NHIs when they extend AI-assisted governance to machine and service identities.

What this signals

Explainability will become a procurement filter for identity governance platforms. Teams that cannot show how recommendations were derived will find it harder to defend AI use in certification, SoD, and documentation workflows. The practical signal is clear: if the model cannot explain itself, it will eventually become a review bottleneck rather than a productivity gain.

Identity programmes should expect AI to move from advisory to embedded workflow logic. That means governance teams will need to define where recommendation ends and authority begins, especially when role data, access evidence, and policy text are consumed by multiple systems. For a broader control baseline, align the programme to the NIST Cybersecurity Framework 2.0 and tighten reviewable decision paths.

Role quality will increasingly determine AI quality. If attribute data and entitlement maps remain inconsistent, AI will surface the same problems faster rather than solve them, which turns data hygiene into a governance priority rather than a back-office task. The named concept here is explainability debt: the gap that appears when a platform can produce recommendations faster than it can justify them.

For practitioners

• Require visible rationale for every AI recommendation Ensure access, role, and documentation suggestions can be traced to the attributes, rules, or patterns that triggered them. If reviewers cannot explain why a recommendation exists, it should not enter a certification or approval workflow.
• Keep final access decisions with accountable humans Use AI to prioritise cases and surface anomalies, but preserve human approval for entitlements, exceptions, and recertification outcomes. That keeps governance evidence intact and avoids turning assistance into delegated authority.
• Fold data-quality checks into normal IAM workflows Flag mismatched attributes, stale role descriptions, and inconsistent entitlement patterns during reviews instead of running separate cleanup programmes. This reduces decay without creating a parallel governance process that nobody maintains.
• Treat MCP as an identity data control surface If identity governance content is exposed through MCP, apply explicit authorization, logging, and consumer scoping. The interface can be useful, but every additional consumer of role and policy data increases governance exposure.

Key takeaways

• Explainable AI matters in IAM because governance decisions need auditable reasoning, not only high statistical accuracy.
• The main benefit of AI in identity governance is better prioritisation of reviews, role analysis, and documentation work, while humans retain decision authority.
• Identity teams should treat explainability, data quality, and interface governance as linked control requirements, especially when MCP exposes governance data to other systems.

Key terms

• Explainable AI: Explainable AI is an AI approach that shows why a recommendation was made, not just what it recommends. In identity governance, that means surfacing the data patterns, rules, or signals behind access, role, or recertification suggestions so reviewers can challenge them and preserve auditability.
• Identity Governance: Identity governance is the discipline of controlling, reviewing, and evidencing who or what has access, why that access exists, and whether it remains appropriate. It covers certifications, segregation of duties, role management, and lifecycle controls across human and non-human identities.
• Model Context Protocol: Model Context Protocol is a standard that lets AI-enabled tools query systems and data sources through a common interface. In identity governance, it can expose role, policy, and access evidence to other systems, which is useful but also creates a new interface that must be authorised and monitored.
• Recertification: Recertification is the periodic review of access to confirm it is still needed and properly assigned. In AI-assisted IAM, recertification workflows should use automation to prioritise attention, but the human reviewer still owns the approval decision and the resulting audit evidence.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity security are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or governance maturity, it is worth exploring.

This post draws on content published by Nexis: IAM Why 99% Accurate AI Isn’t Good Enough for Identity Governance. Read the original.