Topic starter
25/06/2026 5:21 pm
TL;DR: AI can improve identity governance when access modelling is clean enough to support reliable recommendations, according to SailPoint. Role sprawl and review fatigue make manual certification less effective and more prone to rubber-stamping.
Editorial analysis by NHI Mgmt Group, based on content published by SailPoint: “Reimagine identity security with AI: Intelligent access. Resilient security.”.
Key questions
Q: Why do role sprawl and review fatigue create more identity risk?
A: Because they reduce the chance that reviewers will notice what is genuinely unusual.
Q: How do teams know if automated access reviews are actually working?
A: Automated reviews are working when exception rates fall, reviewer overrides become rare, and access decisions are grounded in clean role definitions rather than ad hoc exceptions.
Q: What breaks when AI is layered onto a messy access model?
A: AI mostly accelerates the weaknesses already present in the model.
Practitioner guidance
- Rationalise the access model first Consolidate overlapping roles, remove unused entitlements, and define what normal access should look like before expanding AI-assisted governance.
- Use AI recommendations as review input, not decision authority Require reviewers to validate peer-group outputs against business context, especially where access is sensitive, exceptional, or time-bound.
- Define an outlier baseline by function Separate legitimate job-function exceptions from true privilege anomalies so the outlier signal stays actionable and does not become review noise.
Bottom line: AI can improve identity governance, but only when the underlying access model is already clean enough to support reliable recommendations.
Glossary terms: Access model, Role Sprawl, Identity outlier, Access Certification
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 1 day ago by NHI Mgmt Group
25/06/2026 5:58 pm
Cleaner access models are the real prerequisite for AI-assisted identity governance: AI does not solve access chaos, it amplifies whatever structure already exists. If roles are bloated, review decisions are inconsistent, and entitlement data is noisy, machine learning will simply scale that disorder more efficiently. The practical conclusion is that governance maturity still starts with access model hygiene, not with automation.
A question worth separating out:
Q: What is the difference between access modelling and access certification?
A: Access modelling is about defining and simplifying the structure of access, while certification is about periodically validating whether access should remain in place. Modelling shapes the access estate itself. Certification checks that the estate still matches business need, so weak modelling makes certification harder and less reliable.
👉 Read our full editorial: AI-driven identity security still depends on cleaner access models