Topic starter
06/11/2026 6:36 pm
TL;DR: AI should move IAM beyond manual, reactive operations by using specialized engines for recertification, anomaly detection, provisioning and governance, coordinated through a federated four-tier model, according to Opti. The central challenge is not model quality but whether IAM programmes can keep policy, workflow and compliance aligned as automation expands.
Editorial analysis by NHI Mgmt Group, based on content published by Opti: “AI in IAM: Strategic Framework for Identity Governance”.
Key questions
Q: How should teams govern agentic access when AI systems move faster than access reviews?
A: Teams should move governance earlier in the lifecycle and treat issuance, delegation and device trust as the main control points.
Q: How do federated IAM architectures help automation scale?
A: Federated IAM architectures help automation scale by separating local identity stores, authentication, and policy enforcement while a central orchestration layer coordinates provisioning, approvals, and access decisions across domains.
Q: What makes a good first AI use case in IAM?
A: A good first AI use case in IAM is a narrow, low-risk workflow with clear input data, repeatable decisions, and human review, such as access request triage or entitlement recertification drafting.
Practitioner guidance
- Define a federated IAM operating model Split IAM AI use cases into specialist functions for recertification, anomaly detection and provisioning, then assign a separate orchestration layer to coordinate action and logging.
- Separate recommendations from execution Keep AI analysis outputs distinct from workflow engines and policy enforcement so the system can explain who recommended an action and who executed it.
- Score pilot use cases before scaling Use a weighted prioritisation model that balances financial impact, implementation complexity, organisational readiness and strategic value before approving automation work.
Bottom line: AI can improve IAM only when it is embedded in a governed operating model rather than layered on top of manual workflows.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
06/11/2026 6:41 pm
AI will not fix IAM by automating yesterday's operating model. The real value comes when organisations redesign IAM as a governed system of specialised decision services, not as a faster version of the same manual workflow. That shift matters because access review, provisioning and anomaly detection each depend on different evidence and risk tolerance. Practitioners should treat AI as an operating-model change, not a tool insertion.
A few things that frame the scale:
- Nearly 60% of IT leaders cite restrictive cost and complexity as a weakness of legacy identity governance, according to the 2025 State of Identity Governance Report.
A question worth separating out:
Q: How can IAM teams tell whether automation is improving governance or just speed?
A: By checking whether automated workflows still produce clear approvals, current app ownership, accurate renewal decisions, and complete deprovisioning evidence. If those artefacts are missing, the organisation has accelerated processing without improving governance. Effective automation should make decisions easier to verify, not just faster to complete.
👉 Read our full editorial: AI in IAM needs federated governance, not isolated quick wins