Should organisations use AI for identity governance before they clean up data and policies?

Why This Matters for Security Teams

Identity governance tools only work when the underlying data is trustworthy. If service accounts are duplicated, entitlement names drift across systems, or approval rules are written in inconsistent language, AI will not “fix” governance. It will scale ambiguity. That is why current guidance suggests treating AI as an accelerator after data hygiene, not as a substitute for it. NIST Cybersecurity Framework 2.0 emphasises governance and repeatable risk decisions, while NHIMG research shows how often weak NHI controls already translate into compromise.

The risk is especially high for non-human identities because they are numerous, often overprivileged, and frequently poorly inventoried. NHIMG’s Ultimate Guide to NHIs notes that NHIs outnumber human identities by 25x to 50x in modern enterprises, and that 97% carry excessive privileges. When those records are messy, AI-driven recommendations can appear confident while still being wrong. Security teams that skip cleanup usually discover the problem only after access reviews, audit findings, or incident response expose the inconsistency.

In practice, many security teams encounter AI governance failures only after access recertification has already produced contradictory results across directory, cloud, and SaaS systems.

How It Works in Practice

The safer sequence is to standardise the identity and policy foundation first, then use AI for scale, triage, and prioritisation. Start by normalising identity records so each NHI has a clear owner, purpose, system boundary, and lifecycle state. Then collapse duplicate entitlement labels, remove stale roles, and make approval criteria machine-readable. This is the point where AI can help, because it can sort, cluster, and flag exceptions without inventing governance logic.

For identity governance, the best pattern is usually human-defined policy with AI-assisted execution. Use NIST Cybersecurity Framework 2.0 to anchor governance, then apply policy mapping to determine which entitlements are allowed, which are conditional, and which require review. For the NHI lifecycle, NHIMG’s lifecycle guidance is useful for structuring creation, rotation, offboarding, and exception handling so AI evaluates against stable inputs.

• Define one canonical identity record per NHI, including owner, system, and expiry.
• Convert approval rules into explicit policy statements, not prose in tickets.
• Use AI to identify likely duplicates, stale entitlements, and review outliers.
• Require deterministic approval or denial for high-risk access, with AI only assisting analysis.
• Measure data quality before measuring AI decision quality.

Where this breaks down is in environments with fragmented directories, free-text policy exceptions, and unmanaged service accounts because the model cannot infer a reliable governance baseline.

Common Variations and Edge Cases

Tighter pre-cleanup controls often increase operational overhead, requiring organisations to balance speed against governance accuracy. That tradeoff is real, especially during mergers, cloud migrations, or rapid platform modernisation. In those cases, teams may want AI immediately to reduce review volume, but current guidance suggests limiting AI to recommendation and detection modes until policy and entitlement data are stabilised.

There is no universal standard for this yet, but the practical rule is simple: if a reviewer cannot explain why a given NHI should or should not have access, AI should not be allowed to make that decision autonomously. For organisations with mature identity programmes, AI can help surface patterns in large review sets, classify low-risk exceptions, and highlight drift across environments. For immature programmes, it often just automates bad labels faster. NHIMG’s Top 10 NHI Issues is a useful reminder that overprivilege, poor visibility, and weak lifecycle control are usually the root causes.

In edge cases such as regulatory remediation, AI may still be useful before cleanup, but only for discovery and prioritisation, not final access governance. The goal is to reduce uncertainty first, then introduce automation where the policy model is already dependable.

Related resources from NHI Mgmt Group

• What breaks when organisations adopt AI before cleaning up identity and data sprawl?
• Why is it important to integrate identity and data governance?
• Should organisations prioritise identity governance before expanding agentic AI?
• Should organisations prioritise AI data governance before scaling AI adoption?