Accelerating IAM Implementation

As identity and access management (IAM) evolves with capabilities such as Identity Security Posture Management (ISPM), passwordless authentication, and just-in-time (JIT) provisioning, organizations face a familiar challenge: Why do IAM implementations still take so long?

The reasons why an IAM implementation can take a long time are numerous – lack of clear requirements, constrained resources, project management phase gates to name a few. Often, the biggest obstacle is not the technology itself but the work required to understand the organization’s identity data, applications, and governance processes.

Here at Arcova, we are exploring opportunities to implement faster through AI accelerators AND revisiting the fundamentals of an identity program to help reduce time to value.

Why Do IAM Implementations Take So Long?

Break down a typical IAM project plan and the configuration work is only a fraction of the timeline. Most of the effort goes to discovery, documentation, and validation.

Recently, a client asked if purchasing an AI entitlement description helper tool would resolve their issues with reviewers not knowing the context of what they are approving during an access review. We walked through what data the tools would touch and how every generated artifact would be reviewed during our initial conversations of using this tool or other AI accelerators. This initial overview gave our client reassurance that we would be doing all the right things with respect to implementing accelerators while keeping their data secure.

After a few discovery sessions, we found that almost all entitlements did not have enough information for the AI tool to begin creating correct and useful descriptions. No amount of automation can produce accurate results without getting consistent and reliable information first. If incorrect or volatile information is the input, then the expected output should be the same. Migrating inconsistency faster only produces a faster version of the same problem. Instead, we helped design a simple process to define descriptions at no additional cost.

How Can Organizations Improve Identity Governance Across Employees, Contractors and Vendors?

In another case, a client came to us looking for help to reduce the time to onboard applications, which was averaging about 6 months from start to finish. The client had 5-6 discovery sessions per application and had a difficult time gathering basic information about the application. We were able to compile a list of questions that would be asked during these sessions, and created a self-service tool that could be used by business owners for application onboarding. The user would simply input their configuration information into clear and detailed fields, which would then go to the identity team to review and then approve the tool to auto-generate the connection object with secured connection details and deploy to the lower environment. Additionally, the tool logged each decision that was made and by whom, and requires both the business owner and the governance team to approve of the onboarding request before it can be deployed. None of these activities are glamorous, but each of them directly affects whether the implementation is safe, supportable, and auditable.

In our experience, AI tools cannot be used as a set-it-and-forget-it solution for all of our implementation problems. The goal is not autonomous IAM implementation, but rather to give practitioners a better starting point and a faster path to making decisions.

Accelerators can create initial connector requirement packages that cover most common configurations. For a modern target platform such as Saviynt, this can reduce the blank-page work while preserving architectural review and platform standards.

Design documents, SOPs/runbooks, requirement documents, and knowledge-transfer materials all benefit from structured templates. The value added is making good documentation easier to create and maintain, not eliminating the need entirely.

A tool that produces an interesting answer outside the project workflow will not create sustained value. A tool that produces a reusable artifact at the right stage, in the right format, can dramatically increase speed to value.

What Are the Best Practices for Using AI Accelerators in IAM Implementation?

Now, as great as it would be for AI to be the answer to all of our problems, we must bring ourselves back down to earth. AI does not have the decision-making skills to resolve conflicting business priorities, nor the context to assign ownership, approve risk, or create stakeholder alignment. It cannot accept an audit finding or determine whether an entitlement should become birthright access just because it is statistically common.

Using AI accelerators also creates responsibilities of its own. Teams must govern what types of data the accelerator can access, how prompts and outputs are retained, which models and libraries are approved, and how generated artifacts are reviewed.

Before introducing any accelerators to our clients, we spend several weeks doing discovery of the client’s source data, application inventory, and entitlement metadata to see whether there was enough reliable input for AI to produce something useful. When the data was lacking or inconsistent, we focused on what information was available, and how we could work with other teams within the organization for the additional context needed for accelerators to be usable instead of forcing them in.

A Practical Approach to AI-Accelerated IAM Delivery

1. Start with a bounded use case rather than trying to automate the implementation lifecycle. Target true current state pain points, not pie-in-the-sky enhancements that require many steps before they provide value. Define the approved inputs, the expected output, the reviewer, and the acceptance criteria.

2. Integrate the accelerator into the delivery method. Create a requirements template that can cover 80% of expected requirements, allowing your team to focus on questions around edge cases and complex design decisions. Accelerators can read platform documentation to identify which specific configuration details are important and create an application onboarding questionnaire ready to send to app owners, instead of expecting them to come prepared with all the answers we need.

3. Measure what changed. Look for directional improvements in discovery effort, workshop readiness, issue detection, documentation consistency, and test coverage. Maintaining high-quality data and outlining clear requirements should be the focus before any accelerators can be used to speed up design and development. Remember, if garbage goes in, then garbage comes out.

What Does More Efficient IAM Delivery Ultimately Require?

The most successful IAM programs are not necessarily the ones using the most sophisticated technology. They are the ones that understand their identity data, make deliberate governance decisions, establish repeatable integration patterns, and design lifecycle processes the organization can actually maintain and operate. By working deliberately with our clients’ IAM teams, we have been able to create accelerators that can onboard applications in a matter of minutes instead of weeks, and make customizations more specific for individual environments instead of relying on a one-size-fits-all solution.

The future of IAM delivery will not be AI-led or human-led. It will be AI-accelerated and human-accountable. That is how we expedite the boring parts while maintaining security so we can focus on shaping what’s next.

To learn more about how AI accelerators can strengthen your IAM strategy, visit Arcova’s identity and access management page.: https://arcova.com/iam-identity-access-management/accelerating-identity/.