Topic starter
27/06/2026 1:00 pm
TL;DR: Nexis reports that AI in identity governance only works when recommendations stay auditable, because 99% accuracy still leaves room for compliance failures and privilege mistakes. Explainability keeps access reviews, role recommendations, and governance documentation deterministic enough for practitioners to verify before acting.
Editorial analysis by NHI Mgmt Group, based on content published by Nexis: “Why 99% Accurate AI Isn’t Good Enough for Identity Governance”.
Key questions
Q: When does explainable AI become necessary in identity governance?
A: Explainable AI becomes necessary when the output affects access, recertification, segregation of duties, or governance documentation that must be audited later.
Q: Why can 99% accuracy still fail IAM governance needs?
A: Because IAM decisions are judged by the exception, not the average.
Q: What do security teams get wrong about access reviews?
A: Teams often treat access reviews as proof of control, when they are really only a point-in-time check.
Practitioner guidance
- Define an explainability threshold for IAM use cases Require every AI-assisted access review, role suggestion, or risk flag to show the rule, pattern, or attribute set behind the recommendation before it can influence a decision.
- Separate triage support from decision authority Use AI to surface outliers and prioritise reviewer attention, but keep approval, rejection, and remediation decisions inside the governed workflow.
- Treat MCP exposure as a governance boundary Inventory which systems and agents can query identity data through MCP, then constrain those queries to approved identity governance use cases and logged access paths.
Bottom line: Explainable AI matters in IAM because access and recertification decisions need to be defensible, not merely statistically likely to be correct.
What's in the full article
Nexis's full article covers the operational detail this post intentionally leaves for the source:
- Examples of how NICO explains flagged outliers during access reviews
- Workflow details for AI-assisted role management and governance documentation
- The BYO LLM architecture discussion and how it keeps model choice inside enterprise boundaries
- How MCP exposure is used to query identity data across enterprise tools
👉 Read Nexis's analysis of explainable AI in identity governance →
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
27/06/2026 2:08 pm
Accuracy is not the same as governance fitness: Identity decisions fail when the 1% exception matters, not when the average model score looks weak. IAM programs need outputs that can be inspected, challenged, and reproduced because access reviews and role governance are accountability exercises, not prediction contests. The implication is that model quality alone cannot justify use in approval workflows.
A few things that frame the scale:
- Nearly 60% of IT leaders cite restrictive cost and complexity as a weakness of legacy identity governance, according to the 2025 State of Identity Governance Report.
A question worth separating out:
Q: How should organisations govern MCP servers in identity programmes?
A: Organisations should inventory MCP servers like any other machine-facing access layer, then recertify exposed capabilities, remove unused tools, and keep state-changing actions tightly scoped. The goal is to reduce what an agent can even see as callable. That is a governance control, not just a software design preference.
👉 Read our full editorial: Explainable AI in identity governance: why 99% accuracy falls short