Why do identity programmes struggle with AI even when the automation looks efficient?

Why This Matters for Security Teams

Identity programmes break down when they optimise for speed but not for control. AI can accelerate provisioning, policy lookups, and ticket handling, yet those gains do not solve the harder problems of ownership, approval quality, entitlement review, or revocation. In environments with NHIs, the risk is amplified because machine identities outnumber humans and often persist far beyond the task that created them, as described in the Ultimate Guide to NHIs.

This is why practitioners should be cautious when automation is presented as governance. NIST Cybersecurity Framework 2.0 emphasises continuous risk management, not just workflow efficiency, and that distinction matters when AI is drafting approvals or suggesting access changes faster than reviewers can validate them. The NIST Cybersecurity Framework 2.0 is useful here because it frames identity as an ongoing control function, not a one-time administration task.

NHIMG research shows how fragile that control function becomes in real organisations: in the Ultimate Guide to NHIs, 71% of NHIs were not rotated within recommended time frames, and only 20% of organisations had formal offboarding and revocation processes for API keys. In practice, many security teams discover these gaps only after access has already spread through automation, rather than through intentional governance design.

How It Works in Practice

Effective identity programmes treat AI as an acceleration layer, not an authority layer. That means the model can help draft, classify, summarise, or route identity work, but it should not be allowed to finalise access decisions without policy-backed validation. In current guidance, the safest pattern is to bind AI into a control loop where requests are evaluated against source-of-truth identity data, current risk posture, and explicit approval rules before any entitlement is issued.

For NHI-heavy environments, that control loop should include short-lived credentials, strong workload identity, and revocation tied to task completion. The Top 10 NHI Issues highlights why this matters: persistent secrets, excessive privileges, and poor visibility are common failure modes. AI can help identify stale accounts or classify access requests, but it cannot replace the need for deterministic policy enforcement.

• Use AI to triage identity tickets, not to approve high-risk access autonomously.
• Require policy-as-code checks before provisioning, especially for privileged or production entitlements.
• Prefer JIT access and ephemeral secrets over long-lived credentials with static expiry assumptions.
• Anchor agent and workload access to cryptographic identity, such as OIDC-based workload assertions, rather than human-style roles alone.
• Log the policy reason, approver, and context so revocation and audit can be traced later.

Where this guidance becomes most fragile is in large hybrid estates with multiple directories, custom entitlement systems, and legacy service accounts, because AI can speed up orchestration while leaving the underlying identity sources fragmented and inconsistent.

Common Variations and Edge Cases

Tighter AI-assisted identity control often increases review overhead, so organisations have to balance faster processing against the cost of stronger validation. That tradeoff is especially visible when teams try to automate joiner-mover-leaver workflows, third-party access, and service account governance at the same time.

Best practice is evolving for AI-generated recommendations in identity operations. Some programmes use AI only for summarisation and risk scoring, while others allow limited auto-remediation for low-risk changes. The important distinction is that recommendations are not decisions. For machine identities, this becomes even more sensitive because autonomous workloads can chain permissions, reuse secrets across systems, and create access paths that were not present in the original request.

NHIMG research on breaches such as 52 NHI Breaches Analysis reinforces that weakness. When teams treat automation speed as proof of control maturity, they often miss the slower work of entitlement cleanup, approval quality, and revocation enforcement. Current guidance suggests using AI to improve visibility and consistency, but not to dilute ownership or bypass control evidence. In practice, the most common failure appears when organisations automate the front end of identity while leaving stale privileges, orphaned secrets, and unclear accountability untouched.

Related resources from NHI Mgmt Group

• What should IAM teams prioritise as identity programmes scale?
• What makes agentic AI an NHI governance issue?
• Why do AI agents increase non-human identity risk in existing IAM programmes?
• Why do non-human identities create compliance risk even when policies exist?