Topic starter
08/06/2026 4:15 pm
TL;DR: C1.ai argues that as organisations add more applications, distributed teams and non-human identities, manual reviews, static policies and human-driven approvals no longer scale, especially as AI identities are expected to outnumber human users 25:1. Governance is shifting from review-heavy administration to policy-driven, AI-assisted decisioning because the bottleneck is now the control model itself.
Editorial analysis by NHI Mgmt Group, based on content published by C1.ai: “From Manual to Intelligent: Using AI to Mature Your IGA Program”.
Key questions
Q: How should security teams use AI in identity governance without weakening controls?
A: Use AI as a triage and interface layer, not as a control replacement.
Q: What breaks when manual access reviews are used for growing NHI estates?
A: Manual reviews break when the number and pace of access decisions exceed what humans can inspect consistently.
Q: How do you know if AI-assisted IGA is actually improving governance?
A: Look for fewer inconsistent outcomes on similar requests, clearer exception handling, and stronger auditability of why a request was approved or denied.
Practitioner guidance
- Define which access decisions can be policy-driven Separate routine approvals from exception cases so AI-assisted workflows only automate decisions that are already governed by clear entitlement rules.
- Enrich review workflows with contextual signals Feed requestor context, entitlement sensitivity, login anomalies, and approver status into certification and request decisions so reviewers see risk before they approve.
- Extend governance to non-human identities Create explicit review and approval paths for service accounts and AI agents instead of forcing them through employee-centric certification cadences.
Bottom line: Manual reviews are no longer a reliable primary control when identity estates expand across people, machine accounts, and AI-driven access paths.
What's in the full article
C1.ai's full blog covers the operational detail this post intentionally leaves for the source:
- Thomas request-enrichment logic for access approvals and review tasks
- Copilot workflow examples for bulk certifications, policy building, and helpdesk intake
- Context signals used in governance decisions, including login activity and approver availability
- Operational distinctions between automated recommendations, routed approvals, and escalations
👉 Read C1.ai's analysis of AI maturity in IGA and manual review limits →
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 4 days ago by NHI Mgmt Group
08/06/2026 5:48 pm
Manual review is becoming a governance bottleneck, not a governance strategy. Review-based IGA assumes people can inspect enough context, fast enough, to keep pace with identity growth. That assumption fails when applications, entitlements, and non-human identities expand faster than human approvers can reason about them. The implication is that governance must move closer to policy enforcement and decision automation.
A few things that frame the scale:
- NHIs outnumber human identities by 25x to 50x in modern enterprises, according to the Ultimate Guide to NHIs.
- 59% of organisations say they lack viable alternatives to standing privileged access for NHIs and AI agents, according to Delinea research.
A question worth separating out:
Q: Why do service accounts and AI agents need different controls from human users?
A: Service accounts and AI agents authenticate and act without the predictable patterns that human identity systems expect. They can operate across runtimes, scale quickly, and carry permissions into automated workflows. That means access decisions should consider workload context, runtime behaviour, and time-bound authority rather than relying only on user-centric IAM patterns.
👉 Read our full editorial: AI maturity in IGA is shifting governance from manual review
This post was modified 4 days ago by NHI Mgmt Group