Notifications
Clear all
Topic starter
22/08/2026 12:00 pm
TL;DR: Identity programmes are shifting from manual configuration to agent-led execution, which changes how practitioners think about control, evidence, and approval gates, according to C1.ai. The deeper issue is that an onboarding flow starts from an identity goal, reads the live tenant, and assembles governance tasks, AI access setup, and approvals with an autonomous worker that can complete multi-step jobs across connected systems.
NHIMG editorial — based on content published by C1.ai: C1 Deploy: Onboarding that does the setup for you
Questions worth separating out
Q: How should teams govern agentic onboarding in identity programmes?
A: Treat agentic onboarding as a governed execution path, not a setup convenience.
Q: What breaks when onboarding depends on manual configuration before any value appears?
A: Projects stall when every connector, mapping, and review rule has to be built by hand before the first outcome is visible.
Q: How do AI access controls change when MCP tools are discovered at runtime?
A: MCP discovery turns tool access into an identity governance problem because each exposed tool becomes a potential action surface.
Practitioner guidance
- Validate live tenant discovery before automation expands it Check that directory relationships, manager mappings, and employment status are correct before agentic onboarding uses them to drive review routing or remediation paths.
- Separate approval-gated actions from agent-assisted setup Define which onboarding steps an autonomous worker may plan or execute and which must wait for explicit human sign-off, especially where access changes are sensitive.
- Classify MCP tools as governed access surfaces Apply default sensitive classification to newly discovered MCP tools until the use case, data exposure, and approval requirements are documented and reviewed.
What's in the full article
C1.ai's full blog post covers the operational detail this post intentionally leaves for the source:
- The exact onboarding sequence used to turn a goal into setup tasks inside the tenant.
- How the agent drafts access review work and where human approval is still required.
- The mechanics of AI access management for discovered MCP servers and tools.
- The example of how the autonomous worker produces lineage trails for auditability.
👉 Read C1.ai's blog post on agentic onboarding for identity governance →
Agentic onboarding for identity governance: what changes for teams?
Explore further
View Full Forum → | NHI Foundation Course → | Our Services →
22/08/2026 12:02 pm
Goal-driven onboarding is now part of identity governance, not a prelude to it. When onboarding is built around live tenant discovery and a specific outcome, the governance model shifts from configuration to evidence-led action. That reduces setup friction, but it also means the onboarding flow becomes the first place where entitlement quality, manager coverage, and access routing are tested. Practitioners should treat onboarding as a control plane entry point, not a neutral setup wizard.
A few things that frame the scale:
- Only 20% have formal processes for offboarding and revoking API keys, and even fewer have procedures for rotating them, according to Ultimate Guide to NHIs.
- 91.6% of secrets remain valid five days after the targeted organisation is notified, showing a critical gap in remediation procedures.
A question worth separating out:
Q: What should IAM teams do when autonomous workers can complete multi-step tasks?
A: They should review whether their current governance model assumes a human operator remains in the loop for the full task. If the worker can sequence work independently, then approval points, lineage, and post-action auditability need to be built into the flow rather than added afterwards.
👉 Read our full editorial: C1.ai onboarding shows how identity setup is becoming agentic
