Topic starter
23/06/2026 9:09 pm
TL;DR: C1.ai says modern IGA selection in 2026 hinges on lifecycle management, access certification, just-in-time access, policy-based controls, and NHI governance, with API-first SaaS delivery and automation now part of the baseline rather than a differentiator. The real test is whether governance can keep pace with hybrid identity sprawl without becoming manual review theatre.
Editorial analysis by NHI Mgmt Group, based on content published by C1.ai: “The Modern IGA RFP Guide: How to Choose the Right Identity Governance Platform in 2026”.
Key questions
Q: What breaks when IGA selection ignores lifecycle automation?
A: Governance breaks down when onboarding, mover events, and offboarding still depend on manual intervention.
Q: Why do standing privileges create a higher access management risk?
A: Standing privileges increase risk because they remain available outside the task that justified them.
Q: How do IAM teams know whether access governance is working?
A: IAM teams should look for fast revocation after role change or departure, accurate entitlement data, and low numbers of orphaned or over-provisioned accounts.
Practitioner guidance
- Align IGA scope to the broader IAM strategy Map ownership across IT, security, HR, and compliance before issuing the RFP so lifecycle responsibilities and success measures are explicit.
- Prioritise lifecycle and offboarding controls Verify that the platform can remove access immediately when people leave and can handle onboarding, mover events, and exception handling without manual cleanup.
- Test certification quality, not campaign volume Ask how the platform reduces review fatigue, exposes meaningful entitlements, and maintains auditable evidence for decisions.
Bottom line: The article treats modern IGA as a lifecycle governance problem that spans human users and non-human identities, not as a narrow access review tool.
What's in the full article
C1.ai's full blog post covers the operational detail this post intentionally leaves for the source:
- Sample RFP questions grouped by deployment, architecture, automation, compliance, cost, and customer success
- Criteria for evaluating speed to value, scalability, and customer experience during vendor comparison
- Detailed feature breakdowns for lifecycle management, access certification, JIT access, and segregation of duties
- Examples of how C1 positions its own deployment model, pricing, and AI-assisted review workflow
👉 Read C1.ai's guide to selecting a modern IGA platform in 2026 →
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
25/06/2026 2:17 am
Modern IGA RFPs now have to govern hybrid identity, not just human user access: The article correctly centres lifecycle management, access certification, JIT, and NHI governance because those are the controls that actually determine governance reach. Legacy IGA assumptions break when identities span cloud, SaaS, infrastructure, and service accounts. The implication is that selection must be anchored in cross-domain lifecycle control, not feature completeness.
A few things that frame the scale:
- Nearly 60% of IT leaders cite restrictive cost and complexity as a weakness of legacy identity governance, according to the 2025 State of Identity Governance Report.
A question worth separating out:
Q: How should organisations govern non-human identities inside IGA programmes?
A: Treat non-human identities as governed identities with owners, purposes, expiry paths, and review cycles. Service accounts, API keys, and tokens should enter the same lifecycle discipline as human accounts, with explicit onboarding, certification, rotation, and offboarding steps. If an identity cannot be assigned to a business owner, it should not remain privileged.
👉 Read our full editorial: IGA RFP selection in 2026: what matters for modern identity