Most engineers think…
Most engineers picture certification as a manager clicking 'approve' on a long list of entitlements they've never seen before. That mental model explains why 90 % of certifications are rubber-stamped.
SailPoint IdentityAI changes the framing. Instead of asking 'does this user need this access?' with no context, it asks the ML model: does this user's peer group hold this entitlement? If not, the model surfaces a recommend-revoke. If the user's whole access profile drifts away from any peer group, the identity is flagged as an outlier — a much higher-risk signal than any single entitlement. Understanding the peer-group model, the recommendation verdict, and the outlier risk score is what separates a strong IGA answer from a vague one.
① Peer-group analysis — how ML clusters identities by entitlement similarity
SailPoint IdentityAI builds a network graph where nodes are identities and edges represent shared entitlements. The algorithm calculates pairwise similarity scores — how many entitlements two identities share relative to how many each holds — and then clusters densely connected nodes into peer groups. The result is a set of clusters where members share a common access baseline.
Peer groups are dynamic, not static role assignments. As identities gain or lose entitlements over time, the graph is recomputed and group membership shifts. This means the baseline automatically adapts to real access patterns rather than HR org-chart boxes, which is particularly valuable when job functions drift from their formal title.
The peer-group baseline is what makes everything else work: recommendations, outlier scoring, and role-mining all compare an identity's actual access against the peer-group norm. Without an accurate peer group, every downstream AI signal degrades.
In an interview, stress that SailPoint peer groups are built from actual entitlement similarity, not from the HR organisation chart. A developer who moved to a product role six months ago may still look like a developer in the access graph — the AI catches that drift; a static role assignment won't.
What does SailPoint's peer-group analysis use as its primary input?
② Access recommendations — from entitlement data to certifier-ready verdicts
Once a peer group exists for an identity, SailPoint IdentityAI scores each of that identity's entitlements on two axes: peer prevalence (what fraction of peers hold this entitlement?) and access activity (has the identity actually used this entitlement recently?). The combination produces a recommendation score that maps to one of two verdicts: recommend approve or recommend revoke.
In a certification campaign, these verdicts appear directly in the certifier's review queue alongside the entitlement. The certifier can accept the ML recommendation in one click or override it — and every override is recorded, feeding future model training. This closes the feedback loop: human corrections make the model more accurate over successive campaigns.
Why this matters in practice
Without recommendations, certifiers spend most of their time on low-risk entitlements that the whole team holds. With ML recommendations, high-confidence approvals are pre-flagged, so certifier attention is focused on the recommend-revoke items — the entitlements that look genuinely anomalous. Certification time drops, and the revoke rate on genuine risk rises.
A cluster of identities whose entitlement profiles are similar in the access graph — the baseline for every AI recommendation and outlier score.
A certifier verdict pre-populated by IdentityAI when an entitlement has high peer prevalence and active recent usage — safe to accept in one click.
The ML verdict when an entitlement is rare in the peer group and shows low or no recent usage — the entitlements a certifier should actually examine.
An identity whose whole access profile deviates from every peer group, scored by IdentityAI and surfaced for expedited review — higher risk than any single anomalous entitlement.
Which two signals combine to produce a SailPoint access recommendation score?
③ Identity outliers — the identities whose whole profile is the anomaly
Identity outliers are identities that don't fit cleanly into any peer group — not just one anomalous entitlement, but a whole access profile that looks unlike any typical cluster. SailPoint IdentityAI assigns each such identity an outlier risk score, which combines the degree of deviation from the nearest peer group, the sensitivity of the entitlements involved, and recent access activity.
Outliers are surfaced in a dedicated view in the Identity Security Cloud dashboard, ranked by risk score. An identity analyst can drill into each outlier to see which entitlements are driving the anomaly, compare the identity to its nearest peer group, and trigger an expedited certification or remediation directly from the outlier detail panel.
Common root causes for outlier status include role creep (accumulated entitlements from previous roles that were never revoked), special project access that was never cleaned up, and emergency access grants that became permanent. IdentityAI flags the pattern; the analyst determines which cause applies.
Outlier status signals access anomaly, not malicious intent. The most common cause is benign role creep — forgotten entitlements from a previous position. Always investigate the root cause (role creep, special project, emergency grant) before escalating to security. The outlier score tells you where to look, not what you'll find.
▶ Watch a recommend-revoke verdict surface in a certification
Trace how one anomalous entitlement goes from raw access data to a certifier-ready revoke recommendation. Press Play, then Break it.
An analyst sees an identity with a high outlier risk score. What is the most likely root cause to investigate first?
④ Autonomous governance — AI-driven certification, role mining, and least privilege
SailPoint's autonomous governance capabilities extend beyond surfacing recommendations to automating low-risk certification decisions entirely. When an entitlement's recommendation confidence score exceeds a configurable threshold and it has no policy violations, the platform can auto-certify it without presenting it to a human certifier — dramatically reducing campaign volume while maintaining an auditable decision trail.
On the access-modeling side, role mining uses the same peer-group clusters to propose new roles: if a cluster of identities consistently holds the same set of entitlements, IdentityAI can recommend bundling them into a role, reducing individual entitlement sprawl and making future certifications coarser and faster. Least-privilege scoring then measures how far each identity deviates from the minimum required access, providing a continuous governance health metric.
Agentic Identity Security (2026)
SailPoint's Agentic Fabric — announced in early 2026 — extends identity governance to AI agents (such as Microsoft 365 Copilot, Amazon Bedrock agents, and Salesforce Agentforce), applying the same peer-group and least-privilege principles to non-human identities. This marks the shift from governing human access to governing all identity types in a hybrid human-machine enterprise.
Priya at a Mumbai financial-services firm faces this
During a quarterly access certification, 95% of the 10,000 entitlements are approved within the first hour of the campaign launching — with no evidence the certifiers read a single detail. The CISO flags this as rubber-stamping.
Certifiers have no context on which entitlements are normal versus anomalous, so every item looks equally low-stakes and they click approve on everything.
The certification campaign was launched without enabling IdentityAI recommendations. Every entitlement was presented as raw data with no peer-group comparison or recommend-revoke flag.
Identity Security Cloud ▸ Certifications ▸ Campaign Settings ▸ AI RecommendationsEnable IdentityAI access recommendations on the campaign. The ML model will pre-populate each entitlement with a recommend-approve or recommend-revoke verdict and surface a prioritised outlier list. Re-run the campaign and configure auto-certification for high-confidence approvals to reduce volume, while directing certifier attention to the revoke queue.
The next campaign shows certifiers spending the majority of their time on recommend-revoke items; the revoke rate rises; and audit logs show every auto-certified entitlement met both the confidence threshold and the no-policy-violation condition.
Never enable autonomous auto-certification without first reviewing the confidence-threshold setting. Too low a threshold means low-risk items are correctly auto-certified but borderline anomalous ones can slip through. Baseline the model for at least one manual campaign first, inspect the score distribution, then set the threshold where precision and recall both satisfy your risk appetite.
What must be true before SailPoint can auto-certify an entitlement without presenting it to a human certifier?
🤖 Ask the AI Tutor
Tap any question — instant, scoped to this lesson. No login, no waiting.
Pre-curated from vendor docs + community Q&A, scoped to this lesson. For a live prod issue, paste your export into chat.techclick.in.
📝 Wrap-up assessment — six more
You've answered 4 inline. Six left. 70% (7 of 10) marks the lesson complete on your profile. Tap Submit all answers at the end.
🧠 In your own words
Type one line: what is the difference between a recommend-revoke verdict and an identity outlier flag in SailPoint? Then compare with the expert version.
🗣 Teach a friend
Best way to lock it in — explain it in one line to a teammate. Tap to generate a paste-ready summary.
📖 Glossary
- Peer Group
- A cluster of identities whose entitlement profiles are similar in the IdentityAI network graph — the access baseline used for recommendations and outlier scoring.
- Access Recommendation
- A ML-generated verdict (recommend-approve or recommend-revoke) pre-populated on each entitlement in a certification campaign, based on peer prevalence and access activity.
- Identity Outlier
- An identity whose overall access profile deviates significantly from every peer group, assigned a risk score and surfaced for expedited review.
- Outlier Risk Score
- A composite ML score combining deviation from the nearest peer group, entitlement sensitivity, and access activity anomaly — used to prioritise outlier remediation.
- Role Mining
- IdentityAI analysis of peer-group clusters to propose new roles by bundling entitlements that a cluster consistently holds together.
- Least-Privilege Score
- A continuous governance health metric measuring how far each identity's actual access deviates from the minimum access required for its current function.
- Autonomous Governance
- SailPoint capability to auto-certify low-risk entitlements above a confidence threshold without presenting them to a human certifier, maintaining an auditable decision trail.
- Agentic Fabric
- SailPoint's 2026 framework extending identity governance — peer groups, least-privilege, certifications — to non-human AI-agent identities from platforms such as Copilot, Bedrock, and Agentforce.
- Peer Prevalence
- The fraction of an identity's peer group that holds a given entitlement — low prevalence is a strong signal for a recommend-revoke verdict.
- Role Creep
- The gradual accumulation of entitlements from previous roles or projects that were never revoked — the most common root cause of outlier status.
📚 Sources
- SailPoint — IdentityAI: AI-driven identity security product page. sailpoint.com/products/identity-ai
- SailPoint Documentation — Access Recommendations for Identity Security Cloud. documentation.sailpoint.com/saas/help/ai/access_recs/recommendations.html
- SailPoint Documentation — Identity Outliers: detecting and remediating access anomalies. documentation.sailpoint.com/saas/help/ai/access_insights/outliers.html
- SailPoint — AI Services: AI insights for better security (Atlas platform). sailpoint.com/products/identity-security-cloud/atlas/common-services/ai-services
- Help Net Security — SailPoint Agentic Fabric expands identity governance to autonomous AI agents (May 2026). helpnetsecurity.com/2026/05/11/sailpoint-agentic-fabric-expands-identity-governance-to-autonomous-ai-agents
- SailPoint — Harnessing AI and machine learning to improve identity security. sailpoint.com/identity-library/harnessing-ai-and-machine-learning-to-improve-identity-security
What's next?
Got AI recommendations? Next, explore SailPoint Role Management and how AI-built role models reduce entitlement sprawl before it even reaches a certification campaign.