Topic starter
25/06/2026 5:12 pm
TL;DR: AI-driven access recommendations use peer-group and identity-attribute analysis to suggest approve or revoke decisions during access certification, while excluding birthright access and auto-approving low-risk items to reduce review fatigue, according to SailPoint. The deeper issue is that certification only works when reviewers have enough context to make precise revocation decisions, not just rubber-stamp entitlements.
Editorial analysis by NHI Mgmt Group, based on content published by SailPoint: “AI-driven Access Recommendations – Less Certification. More Revocation.”.
Key questions
Q: How should teams reduce certification fatigue without weakening access governance?
A: Use risk-based review queues that separate routine access from sensitive entitlements, so managers are not asked to assess every item equally.
Q: Why do access reviews fail to remove unnecessary permissions?
A: They fail when reviewers see a list of entitlements but not enough context to judge whether the access is still needed.
Q: What are the signs that an access certification campaign is failing in practice?
A: A campaign is failing when reviewers are working from stale data, the review window is too vague, or the process becomes so frequent that people stop giving it proper attention.
Practitioner guidance
- Define review tiers by access risk Separate birthright access, routine low-risk entitlements, and high-risk privileges before recertification so reviewers are not forced to treat every item as equally important.
- Use identity attributes to improve reviewer context Feed role, department, and location into certification workflows so reviewers can compare each entitlement against a meaningful peer group before deciding.
- Suppress obvious low-risk items from certification queues Remove entitlements that do not add governance value from manual review lists so reviewer effort stays concentrated on exceptions and elevated access.
Bottom line: AI-driven recommendations improve certification only when they help reviewers make narrower, more defensible revoke decisions.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
25/06/2026 5:46 pm
Certification fatigue is a governance problem, not just a user-experience problem. When reviewers see long entitlement lists without context, they rationally default to approval because the cost of a false revoke feels higher than the cost of inaction. That creates overprovisioning and weakens the integrity of access recertification. The practical lesson is that certification quality depends on decision quality, not review volume.
A few things that frame the scale:
- 91.6% of secrets remain valid five days after the targeted organisation is notified, showing a critical gap in remediation procedures, according to the Ultimate Guide to NHIs.
- 64% of valid secrets leaked in 2022 are still valid and exploitable today, proving that detection alone is not enough without automated revocation, according to the State of Secrets Sprawl 2026.
A question worth separating out:
Q: What should IAM teams prioritise first in access certification design?
A: Start by identifying which access is birthright, which is routine, and which is genuinely sensitive. Once that split is clear, reviewers can focus on the access decisions where human judgment changes security outcomes.
👉 Read our full editorial: AI-driven access recommendations expose the limits of certification