I am pleased to announce today that at Pax Identity we have fired the starting gun to solve one of the most persistent problems in Access Governance — that of deprecating access models. It is in tune with our mission to address the most stubborn challenges in Identity Management.
An auditor can today walk into any enterprise application audit and identify scores of access control gaps — misconfigured and/or duplicate roles, outdated or absent ownership, wrongly assigned entitlements, unused entitlements and roles, these are just a few of the patterns that continue to recur time and again.
To manage this, large enterprises (50k +employees) have designed elaborate operating procedures for reviews spanning thousands of applications consuming hundreds of thousands of person hours every year. Market leading IGA solutions have helped some by defining workflows for recertification and by adding rudimentary regressions to determine plausible gaps in the static data models that holds together roles and their assignments. But much of the end process is still cumbersome and ineffective.
Is there light at the end of the tunnel? Yes, and that is the Shinkansen heading our way.
We are at the cusp of a decade wherein almost every enterprise process will move from automation to autonomous execution. Economies will dictate the gallop of the “agentic enterprise” as Salesforce calls it — “An agentic enterprise is a business where human employees and AI agents work together in a seamless, collaborative ecosystem”
Here is the catch. This Agentic enterprise will have to adopt the same broken static access models. That is, if one were to build an agent to execute the workflow for evaluation, approval, assignment and raising of a purchase order – for each of these functions, the agent will have to inherit the respective modest Coupa static role that is certified once per annum for assignments and has probably never been certified for composition! What could go wrong, eh?
Access Models are going to become consequential. Probably more consequential than the Identity plane, because one cannot verify an agent that derives its execution logic from weights and biases at runtime, the same way one does a human. For the human, context is a role, an identity, a policy, a job title and a warm fuzzy person you can drop a Teams message to. What is the context for an Agent?
There is a thought in the industry that context is driven by intent. But intent is just a part of it. Context to a large part is derived from Process Sentience. We all know what Sentience is. Well, in my view, Process Sentience is the ability to build an understanding of organisational processes in the frame of other related or unrelated events— an M&A, a divestment, a HR Job definition programme, a new branch, a new entity. This understanding will then drive context and intent. How will our modest Identity Governance solution scale to this understanding?
At our labs, together with our partners, Pax Identity are exploring whether we can harvest enterprise process knowledge at the scale of sentience to build self-healing and auto-remediating access models. Our efforts are being expended on the back of the following bets:
- IGA as it done today will disappear in a few years. The IGA platforms of today will become systems of record. An important, but non-conclusive source of access intelligence
- Security in the Agentic enterprise will be driven as much by Process knowledge and sentience as much as intent at the point of execution
- After decades of emphasis on automation efficiencies with a workflow for every possible edge case, autonomous execution will be the sought after jewel.
- Autonomous Access governance will replace semi-automated/manual processes that are churned by human factories year after year. As a pre-requisite for this, a new stack comprising Access Intelligence and autonomous execution capabilities will be built to secure critical data from compromise.
At Pax, we see ourselves at the centre of this change. We and our development partners are currently working on the most challenging patterns to proof the core hypotheses behind this problem statement. Our first stop will be context graphs, sure, but that is just the beginning. Watch this space…..humans at work!