We've spent really 30 to 35 years building transaction processing systems to manage a human decision to allow a human access to resource. Today we've kind of outgrown that model. Matter of fact, that model and the architecture to it is a bit obsolete. We shouldn't be looking at a transaction processing record keeping function of identity access governance as the solution for enabling identity protection for agents and non-human accounts. That requires different capabilities, newer capabilities, and frankly requires AI to be part of the solution.

The first thing I start with is you need a governance model for AI that balances the strategic imperatives for the business with the right control capability. The best model that I've found is using use cases. Each use case represents a strategic business need that requires some level of control. We design those controls for that use case, then move to the next one, and the next one. Over time you're creating a building block approach to an enterprise governance model for AI.

We can take attribute information about an individual's IT usage and establish behavioral patterns. Those patterns can be represented numerically. When we detect a deviation, we measure that difference and trigger automated workflows that operate in milliseconds. If the deviation is significant enough, we may revoke the entitlement because it's likely not the person who originally had that entitlement that's using it anymore.