What do organisations get wrong about automating identity governance?

They often automate the workflow without hardening the policy. That scales inconsistency, because the system will grant or certify access according to whatever rules exist, even if those rules are incomplete or too permissive. The real work is policy design, not simply workflow acceleration.