IGA (Identity Governance and Administration)
Identity governance and administration (IGA) is the discipline of managing who has access to what, why they have it, and whether it is still appropriate. It includes user provisioning, access reviews, policy enforcement, and audit reporting across an organization's application portfolio.
Why It Matters
IGA has been a mature market category for over a decade, with vendors like SailPoint, Saviynt, and CyberArk serving large enterprises. The core workflow: employees join, receive access based on their role, undergo periodic access reviews, and have access removed when they leave.
AI agents stress-test this model in three ways. Agents inherit permissions through delegation rather than direct role assignment. Agents act faster than review cycles. And agents create compositional risk by chaining multiple system accesses in a single session, which IGA tools designed for individual permission grants cannot evaluate.
The result: IGA remains essential for human identity governance while being insufficient for AI agent governance. Organizations need both.