We’re seeing AI technology becoming increasingly sophisticated at a rapid rate. Generative AI is quickly emerging as one of the biggest technology trends – with ChatGPT, DALL-E 2 and Bing AI being a few of the most popular examples. They certainly aren’t the only examples, and more advancements are being made quickly.

According to Gartner, VC firms have invested over $1.7 billion in generative AI solutions over the past three years. This will have a profound impact on how we do our jobs, across functions and sectors. As organizations look to improve processes and make things more efficient, is there an opportunity for AI to change how identity governance is done? Yes, but it’s important to understand the parameters and limitations first.

AI is a supplement to people, not a replacement for people

AI has the potential to help automate manual and repetitive tasks, but you still need people. It will replace repetitive tasks – and therefore some jobs – but in parallel, it will open the door for new jobs. That will enable organizations to provide more business value, faster. This is true in virtually any application of AI, including how it can help improve the way enterprises do identity governance.

AI still needs the human element to work correctly. It throws up a lot of intriguing possibilities, but human intervention is required to make it usable. Similar to search engines, which many believe ChatGPT is trying to replace, the human asking the question matters, as do the individuals who programmed the AI.

Consider AI in identity security that can suggest access privileges that are developed based on access rights across peer groups. In this case, even if the identity management solution can catalog those suggestions according to what other users are doing across the network, human involvement is still necessary. Why? To determine who are true peers, what kinds of access rights and entitlements are to be granted based on roles, continuously evaluating those roles, and so on.

Using AI and automation effectively

There are at least a few areas where AI-based automation can be very useful within IGA. Two that stand out are:

• Assisted decision-making. The ability to leverage automation and intelligence to improve human decision-making is the foundation of intelligent identity governance and administration (IGA). Wherever possible, important IGA processes such as access reviews, identity lifecycle management, and certification campaigns can also be automated.
• Pattern-finding. Pattern finding classifies data by recognizing patterns or feature similarities. Rather than looking for exact matches, pattern recognition searches for the most likely pattern to classify all of the available information.

For use with IGA, AI-powered automation would find the patterns of user behavior and previously set rules to use as the basis for assigning access – and possibly for detecting anomalous behavior.

Proceeding carefully

Accountability is an important best practice when it comes to any kind of application of AI – not just for identity governance.

You can’t rely on AI and automation alone – these technologies aren’t a substitute for humans and AI cannot be made accountable, so it remains very important to support staff to make more informed decisions based on smart recommendations.

Historically, vendors claimed to use AI but instead implemented machine learning algorithms, which on a practical level means that the machine makes bad decisions until it learns to gradually improve the quality based on experiences. This approach is inconsistent with the idea of accountability.

Another best practice is to be clear and realistic about what you want to achieve and what you can achieve.

AI is not innovating. In this context, it is not detecting new trends and will not try to steer against or advocate for their adoption. It does not contribute new data. It will have problems deciding between correlation and causation. It simply finds patterns in existing data. It has no opinion. So, it’s well suited for processes like those in IGA. AI is kind of like working with a trainee - it can help make you more efficient and take over certain chunks of work, but you have to supervise it and do a thorough review, ensuring you always have the final say on important decisions.

AI for better identity governance

AI technology is growing increasingly sophisticated – and easier than ever to use. The rise of ChatGPT and other generative AI offers applications that seem limited only to the imagination. Yet when working with AI, the human element is still necessary. This can be a powerful combination when applied to identity governance and administration.

Start with a clear understanding of your goals, and don't forget the accountability aspect, and you will be on your way to stronger IGA with less manual input.