← AI in IAM: Automating the Enterprise Without Breaking Compliance

AI in IAM: Automating the Enterprise Without Breaking Compliance

Reference Architecture Walkthroughs

Two full walkthroughs, tying together everything from this course into an architecture you could actually build. Both companies and every system name are fictional.

Walkthrough 1: the access request agent at Northwind Traders

Northwind Traders is a mid-size distribution company running SailPoint ISC for identity governance. Employees have always been able to self-request access, but the catalog of a few hundred access profiles is named in IT shorthand nobody outside IT can parse, so most requests go through a help desk ticket instead. The goal: let people ask in plain language and still land in the exact same governed request flow.

Employee types a request"I need to run month-end close reports" into the existing access request portal's search box
↓
Retrieval agentEmbeds the request, matches against the requestable access-profile catalog, returns the top 3 candidates with plain-language descriptions
↓
Policy and SOD checkSame deterministic check every manual request already runs, no exceptions for agent-originated requests
↓
Manager approval, AI draft attachedThe certification copilot's plain-language justification is shown, editable, never final until the manager submits
↓
Standard provisioningGrant flows through the normal provisioning engine and its retry logic, no different path for an AI-assisted request

The part worth noticing: the AI touches exactly two steps, finding candidates and drafting a justification, and both outputs are fully overridable before anything is submitted. The policy check, the approval step, and the provisioning engine are completely unchanged from the process that existed before this project. If the AI service went down entirely tomorrow, employees would fall back to browsing the catalog manually, slower, but the request flow keeps working.

Walkthrough 2: JML and SOD anomaly detection at Meridian Health Group

Meridian Health Group is a fictional healthcare provider where access sprawl from transfers is the single biggest audit finding two years running: people who moved departments keep the old department's access indefinitely. The project targets that specifically, plus a standing gap in their SOD program (real conflicts nobody had written a policy for yet).

HR systemAuthoritative source: hires, transfers, terminations
↓
Deterministic coreAggregation, correlation, lifecycle state, birthright provisioning. No AI, ever.
↓ event triggers ↓
Mover agentComputes the access diff on every transfer event, drafts add and revoke proposals
↓
SOD anomaly scan (scheduled, separate)Flags entitlement pairs that look like undeclared conflicts across the whole access catalog
↓
Governance: agent as identityBoth agents are service accounts inside the same platform, certified on the same schedule as every human account

The mover agent alone closes most of the audit finding: every transfer now produces an explicit access diff with a reason attached, instead of relying on someone remembering to manually clean up old access. The SOD anomaly scan runs on an entirely separate schedule from the mover agent and never blocks a live transfer, its output is a queue for the compliance team, not a gate on provisioning. And because both agents are registered as governed identities inside ISC itself, this quarter's access certification for privileged service accounts includes them by default, no separate process was built to remember to review the AI.

What both walkthroughs have in common

  • Deterministic machinery does the reliable, high-volume work. AI touches only the parts that were previously slow human judgment calls.
  • Every AI output passes through the platform's existing approval and provisioning path, there is no shortcut or bypass lane for agent-originated work.
  • The AI components are themselves governed the same way every other identity in the platform is governed.
  • If the AI service disappeared tomorrow, the underlying process still works, just slower. Nothing critical depends on the AI being available.

If you remember five things from this course

  1. Identity fits AI unusually well and punishes carelessness brutally, perfect workload shape, maximum blast radius, and free-text fields as an injection surface. Design for the trifecta from day one.
  2. Query your facts, embed your judgment. Live API for who has what, a search index for policies, rationale, and your secret weapon: past decisions with outcomes.
  3. The spine is systems wrapped as tools, a durable orchestration graph with cheap workers and a fresh-context reviewer, a human on every write, and fully replayable decision traces.
  4. Govern every agent as a first-class identity inside the platform itself, same story as your non-human-identity program, and the strongest slide you have.
  5. Buy the platform's native AI, build the cross-system brain, earn autonomy on measured accuracy, and publish the never-automate list next to the roadmap.

Do that, and AI stops being a liability in identity and starts being the most tireless, best-documented analyst on the team, one whose every decision you can actually explain to an auditor.