Topic starter
06/07/2026 9:35 am
TL;DR: Role mining fails when teams rely on spreadsheets, siloed data, and manual policy validation, according to Lumos. The governance lesson is that access modelling now has to absorb continuous context, not just cleaner workflows, and Lumos says Albus applies agentic AI to attribute analysis, access mapping, and RBAC/ABAC policy generation.
Editorial analysis by NHI Mgmt Group, based on content published by Lumos: “Using Albus for Role Mining: The Agentic Way to Build Smarter Access Policies”.
Key questions
Q: How should teams handle role mining when identity data is fragmented across systems?
A: Treat fragmented identity data as a governance issue first.
Q: Why do manual role reviews struggle to keep access policies current?
A: Because access changes faster than periodic review cycles can absorb.
Q: What are the warning signs that RBAC has outgrown its design?
A: You will usually see many nearly identical roles, ad hoc per-resource checks, and repeated requests for exceptions that only differ by workspace or project.
Practitioner guidance
- Map role mining to live identity sources Connect HRIS, IdP, cloud application and directory data before attempting policy generation so the role model reflects current attributes and entitlements.
- Separate stable roles from contextual access Use RBAC where access patterns are durable and layer ABAC where team, worker type or business context changes too often for static roles to hold.
- Require evidence-backed policy validation Make every generated role or policy recommendation traceable to source attributes, access usage and an explicit reviewer decision.
Bottom line: Manual role mining fails when identity data is fragmented, business context is missing and access patterns change faster than human review cycles.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
06/07/2026 9:50 am
Agentic role mining exposes a governance timing problem, not just a tooling gap. Manual role engineering assumes that enough people can review enough context often enough to keep policy current. That assumption fails once entitlements, attributes and organisational structure change continuously. The practitioner conclusion is that policy governance has to move closer to the moment of data change.
A few things that frame the scale:
- 69% of security leaders agree identity management must fundamentally shift to address agentic AI systems, according to the 2026 Infrastructure Identity Survey.
- Nearly 60% of IT leaders cite restrictive cost and complexity as a weakness of legacy identity governance, according to the 2025 State of Identity Governance Report.
A question worth separating out:
Q: How should organisations choose between RBAC and ABAC for non-human identities?
A: Use RBAC for stable, repeatable access patterns and ABAC when access must change with context, resource type, or environment. For non-human identities, ABAC is usually better when workloads are ephemeral or shared across teams. The practical test is whether the access rule needs to follow the identity alone or the identity plus the conditions around it.
👉 Read our full editorial: Agentic AI role mining exposes the limits of manual RBAC governance