Topic starter
25/06/2026 5:21 pm
TL;DR: AI and machine learning are being used to automate access modelling, certification recommendations, and outlier detection in identity programmes that now span employees, contractors, machine identities, and AI agents, according to SailPoint. The core issue is not intelligence alone, but whether access governance can keep pace with scale, role sprawl, and review fatigue.
Editorial analysis by NHI Mgmt Group, based on content published by SailPoint: “Reimagine identity security with AI: Intelligent access. Resilient security.”.
Key questions
Q: What breaks when AI is layered onto a messy access model?
A: AI mostly accelerates the weaknesses already present in the model.
Q: Why do role sprawl and review fatigue create more identity risk?
A: Because they reduce the chance that reviewers will notice what is genuinely unusual.
Q: How do teams know if automated access reviews are actually working?
A: Automated reviews are working when exception rates fall, reviewer overrides become rare, and access decisions are grounded in clean role definitions rather than ad hoc exceptions.
Practitioner guidance
- Rationalise the access model first Consolidate overlapping roles, remove unused entitlements, and define what normal access should look like before expanding AI-assisted governance.
- Use AI recommendations as review input, not decision authority Require reviewers to validate peer-group outputs against business context, especially where access is sensitive, exceptional, or time-bound.
- Define an outlier baseline by function Separate legitimate job-function exceptions from true privilege anomalies so the outlier signal stays actionable and does not become review noise.
Bottom line: AI can improve identity governance, but only when the underlying access model is already clean enough to support reliable recommendations.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
25/06/2026 5:58 pm
Cleaner access models are the real prerequisite for AI-assisted identity governance: AI does not solve access chaos, it amplifies whatever structure already exists. If roles are bloated, review decisions are inconsistent, and entitlement data is noisy, machine learning will simply scale that disorder more efficiently. The practical conclusion is that governance maturity still starts with access model hygiene, not with automation.
A question worth separating out:
Q: What is the difference between access modelling and access certification?
A: Access modelling is about defining and simplifying the structure of access, while certification is about periodically validating whether access should remain in place. Modelling shapes the access estate itself. Certification checks that the estate still matches business need, so weak modelling makes certification harder and less reliable.
👉 Read our full editorial: AI-driven identity security still depends on cleaner access models