Topic starter
07/06/2026 8:09 pm
TL;DR: C1.ai says identity governance is shifting to continuous, automated, policy-driven operations, with organisations governing about 21,000 identities on average, 98% of access requests automated, and 90% of review tasks completed in under five days. Periodic human-led governance cannot keep pace once software becomes the primary execution layer.
Editorial analysis by NHI Mgmt Group, based on content published by C1.ai: “What Identity Governance Looks Like When Automation Does the Work”.
By the numbers:
- The median organisation completed 90% of access review tasks in under five days.
Key questions
Q: How should security teams govern access when automation handles most requests?
A: Security teams should treat automation as the default execution path and build policy around exception handling, risk thresholds, and enforcement hooks.
Q: Why do periodic access reviews become less effective as environments become more automated?
A: Periodic reviews assume access stays stable long enough to be observed and certified.
Q: What are the signs that an identity governance programme is too slow for current enterprise needs?
A: A programme is too slow when deployments require heavy professional services, integrations need extensive customization, and operational overhead stays high after go live.
Practitioner guidance
- Define policy boundaries for routine access Separate low-risk, high-volume access decisions from exceptions so automation can handle the routine path while humans focus on higher-risk cases.
- Inventory non-human identities as governed assets Create and maintain ownership, purpose, and scope records for service accounts, automation identities, and AI-driven execution paths.
- Shift certification toward exception-based review Reserve manual review for high-risk changes, privileged access, and unusual patterns instead of trying to certify every routine entitlement equally.
Bottom line: Identity governance is shifting from scheduled review cycles to continuous policy enforcement because software now drives most routine access activity.
What's in the full article
C1.ai's full blog covers the operational detail this post intentionally leaves for the source:
- Cross-customer metrics showing how many access requests, reviews, and integrations organisations are handling in practice
- Breakdowns of governance behaviour by organisation size and industry, useful for benchmarking your own operating model
- Narrative examples of how automation changes the day-to-day work of identity teams
- The article's framing of what “normal” looks like when governance is embedded instead of episodic
👉 Read C1.ai's analysis of identity governance at AI speed →
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
07/06/2026 9:57 pm
Identity governance has crossed from periodic administration into runtime control. The article describes a model where automation handles the routine path and humans supervise the exceptions. That is no longer a process optimisation; it is a change in where authority sits. For identity teams, the practitioner conclusion is that governance architecture now has to be treated as part of the live control plane, not as a monthly or quarterly checkpoint.
A few things that frame the scale:
- Nearly 60% of IT leaders cite restrictive cost and complexity as a weakness of legacy identity governance, according to the 2025 State of Identity Governance Report.
A question worth separating out:
Q: Should organisations prioritise automation or access certification first?
A: Automation should come first for routine lifecycle changes because certification cannot correct access that should never have been granted or removed late. Reviews still matter, but they work best as a validation layer after provisioning logic has been tightened. The stronger programme sequence is automated issuance and removal, then periodic certification.
👉 Read our full editorial: Identity governance at AI speed is becoming the new baseline