Autonomous Identity Security for all

Kacey Maher, a senior solutions consultant at SailPoint with 25 years in identity governance, explains why role-based access control exists and how AI can make it sustainable. He covers the case for roles (shared language for access, faster provisioning, least privilege, auditability), then contrasts three design strategies: enterprise-wide RBAC (thorough but prone to role explosion), use-case-based roles tied to a project such as onboarding a new application, and targeted roles for a specific population like bank tellers or seasonal workers, arguing real programs blend all three. He walks through top-down business-role analysis versus bottom-up IT-role mining from applications, stresses cleaning up access before modeling roles, and gives practical rollout tips: agree on an authoritative data source such as job title, ship roles without entitlements first to test assignment logic, then attach access gradually. The second half describes SailPoint's AI features: peer-group-based outlier detection that runs nightly access reviews, access history and review recommendations, and role insight suggestions that flag entitlements to add or roles to refactor as the organization changes, turning role maintenance from a periodic overhaul into continuous, incremental correction.