Topic starter
06/11/2026 6:38 pm
TL;DR: IAM has been stuck for two decades because manual workflows, hard-coded policies, and integration backlogs have kept identity governance from scaling, while security leaders now want AI that can reason about access, normalize entitlements, and automate remediation, according to Opti. The real shift is not chatbots or anomaly detection, but AI-native identity systems that reduce human review failure and services-heavy onboarding.
Editorial analysis by NHI Mgmt Group, based on content published by Opti: “Why Identity Governance Stayed Still for 20 Years”.
Key questions
Q: Should teams use automated access review instead of manual access review?
A: Teams should prioritise automation when the access surface is large, the review cycle is frequent, or the audit evidence must be reproducible.
Q: How should IAM teams handle applications with inconsistent entitlement models?
A: IAM teams should map each application’s entitlements to a common access model, then normalise entitlement meaning into a shared catalogue of roles, privileges, and effective access.
Q: What makes an AI-native identity platform different from traditional IGA?
A: An AI-native identity platform is designed to use AI in the identity workflow itself, for example to classify entitlements, detect access anomalies, draft access decisions, and surface toxic combinations with human review.
Practitioner guidance
- Define where AI can make access decisions Separate low-risk access decisions that can be machine-assisted from high-risk cases that still need human review.
- Map entitlement meaning before automating reviews Document what common roles and permissions actually enable in each major application class.
- Set remediation boundaries for identity changes Specify which revocations, resets, and entitlement removals can be executed automatically and which must stop for approval.
Bottom line: Identity governance struggles when access meaning is opaque, integrations are slow, and review workflows still depend on human guesswork.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
06/11/2026 6:42 pm
AI-native IAM is being adopted because the old governance model has hit an operational ceiling. Manual reviews, hard-coded policies, and bespoke integrations do not scale to modern entitlement volume or application diversity. The market shift here is not about novelty for its own sake. It is about replacing governance work that has become structurally unsustainable with systems that can interpret access context at machine speed.
A few things that frame the scale:
- Nearly 60% of IT leaders cite restrictive cost and complexity as a weakness of legacy identity governance, according to the 2025 State of Identity Governance Report.
A question worth separating out:
Q: How do teams decide when to automate access remediation?
A: Automate only the cases where the policy is clear, the risk is measurable, and the action is reversible. High-volume, low-dispute access reductions are good candidates. Sensitive systems, regulated data, and ambiguous ownership still need human oversight before privileges are changed.
👉 Read our full editorial: AI-native identity governance targets long-standing IAM bottlenecks