Blog

EU AI Act, regulation on artificial intelligence

<h3>An Introduction to Our Approach</h3>With the adoption of the EU's Artificial Intelligence Act in 2024, a new standard for AI regulation has been set. From the very beginning of our journey in building IAMONES, our goal was not just to innovate, but to do so responsibly. This meant engineering our platform with a "privacy-by-design and compliance-by-default" philosophy.Under the AI Act, we are classified as a deployer of AI systems, meaning we integrate leading Large Language Models (LLMs) into our services. This role comes with clear responsibilities, particularly under Article 26 (human oversight) and Article 50 (transparency), which we have taken to heart. This article provides an inside look at the deliberate architectural decisions we made to ensure IAMONES has a low-to-limited risk profile, allowing our clients to adopt Conversational IGA with confidence.<h3>Our Foundational Principles for Compliance</h3>Our compliance posture is built on several key decisions about what we do, and just as importantly, what we choose not to do.<ul><li>A Core Principle: We Do Not Train Models on Customer Data. </li></ul>This is a critical distinction for us. The reasoning engines within IAMONES operate purely on inference. We do not perform any form of automatic or "silent" learning from user actions or data. This means your information is never used to train or modify our models. This was a fundamental choice to guarantee that our outputs are shaped by controlled, secure prompts, not by ongoing data capture.<ul><li>How We Protect Your Data: Programmatic PII Stripping. </li></ul>We built a non-negotiable safeguard into our data flow: before any information is processed by an external LLM, all Personally Identifiable Information (PII) is programmatically stripped. This ensures that sensitive data, such as names or email addresses, never leaves your enterprise boundary in its raw form. For example, a dataset like { "name": "John", "surname": "Doe", "entitlement": "Admin Access"} is instantly transformed into { "name": [NAME], “surname”: [SURNAME], "entitlement": "Admin Access"} before the LLM sees it.<ul><li>Keeping Humans in Control: Our Approach to Oversight. </li></ul>We firmly believe that AI should assist, not replace, human judgment. That’s why we designed IAMONES to treat all AI-generated output as strictly advisory. Any action that could trigger a change in an IGA system—like revoking a permission—is always subject to human-in-the-loop validation before execution. For critical functions, we intentionally pause the process at defined checkpoints to require manual inspection and explicit approval. <h3>The Security Layers We've Built</h3>To support our compliance principles, we have implemented multiple layers of security and governance:<ul><li>An Integrated LLM Firewall: We developed a semantic firewall that intercepts all input queries. It’s designed to block malicious prompt injections, privilege escalation attempts, and inappropriate content before they can be processed.</li><li>Data Residency and Segregation: We support EU data residency for all LLM interactions and provide each client with their own dedicated Temporal Identity Graph (TIG). This guarantees that your IGA data is never shared or exposed across tenants.</li><li>Strict, Granular Access Controls: Our platform translates natural language visibility policies into strict Row-Level Security (RLS) policies at the database level, ensuring users can only see the data they are explicitly authorized to view. </li></ul><h3>Our Ongoing Commitment</h3>Compliance isn't a one-time checklist. It's an ongoing commitment.&nbsp;We conduct annual AI compliance reviews and continuously expand our documentation to ensure we not only meet but exceed regulatory standards as they evolve. This is our promise to our customers: to be a trusted partner in their journey toward a secure and compliant AI-powered future.

How We Engineered IAMONES for EU AI Act Compliance

You have to migrate off your legacy IAM platform today. Many companies, just like yours, are looking to drastically simplify and cut the operational costs of their legacy on-premise IGA platforms, often built more than a decade ago.Until recently, the “move to cloud” was seen as the only path to modernization. But today, the scenario has changed. There's a second option, a strategic crossroads: moving to Born-on-the-LLM vendors.<h3>What's the Real Difference? (Hint: It's Not the Chatbot)</h3>It’s not about having a conversational chatbot, which will be a commodity in 2–3 years. The real, profound breakthrough lies in how you configure and run the system.With a Born-on-the-LLM platform,&nbsp;you program and configure in natural language. No coding, no product specialists. A functional expert can simply write a workflow in plain language (e.g., French), and it just works. In this new paradigm,&nbsp;natural language is the code.In contrast, traditional vendors may add a chatbot layer, but their underlying configuration is still bound to code, semi-code, or endless parameter tuning.<h3>How to Spot a Traditional Vendor? Age Doesn't Lie.</h3>A good way to spot a traditional vendor? Age. Any platform designed before 2023 had no LLM option, it had to be built the old way, maybe with some “Machine Learning” added later. But let’s be clear: ML is not LLM.The TCO (Total Cost of Ownership) comparison is straightforward:&nbsp;hours vs. weeks, agility vs. rigidity, auditor-friendly vs. auditor-adverse.<h3>The Future of IAM is a Choice</h3>Now, let’s be honest: the IAM world is still conservative. A good chunk of practitioners believe AI and LLM are just hype. But there’s a growing faction that clearly sees their potential and benefits.So, this is the crossroad you are facing: will you go Traditional, or will you go Born-on-the-LLM?&nbsp;

Your IAM Platform is at a Crossroads: Traditional or Born-on-the-LLM?

Retro Computer Setup Featuring CRT Monitor On Desk

For years, we’ve been told that Identity and Access Management (IAM) is a fundamentally broken discipline. We've accepted that projects will be slow, interfaces will be clunky, and getting a simple policy implemented requires a small army of consultants and developers.But what if we've been looking at the problem all wrong? IAM isn't truly broken. The core engines of our Identity Governance (IGA) platforms are powerful. They can manage millions of entitlements and enforce complex rules.The problem is that they're hopelessly outdated. The way we interact with these powerful systems is stuck in the past, trapped behind user interfaces and configuration models designed decades ago.<h3>The Friction of Translation</h3>If you work with a legacy IAM stack, you live this frustration every day. You know exactly what you want to do, but getting the system to understand you is a nightmare. You're forced to become a translator, converting clear business intent into a cryptic series of clicks, dropdown menus, and custom scripts.<ul><li>You want to say: "Create a role for contractors that gives them VPN access and read-only rights to the 'Project-Alpha' SharePoint site, but only for 90 days."</li><li>The system forces you to: Navigate 12 different screens, create an access policy, define a role, set lifecycle parameters, find the correct application entitlements, and link them all together, praying you didn't miss a step. </li></ul>This gap between human intent and system logic is the source of all the pain. It’s what makes IAM slow, expensive, and inflexible. The system itself isn’t broken; the user experience is.<h3>Language is the Ultimate User Interface</h3>So, how do we fix it? Not with another layer of complex UI, but by ditching the old model entirely. The solution is to use the most intuitive interface ever created: natural language.Conversational AI isn't just a "nice-to-have" feature. It is the necessary evolutionary step to rescue IAM from its own complexity. It’s an intelligent layer that sits on top of your existing stack and finally allows you to speak the same language.At IAMONES, we’ve built our platform on this very principle. Instead of forcing you to learn the machine's language, we taught the machine to understand yours.When you can simply state your policy, the entire dynamic changes. The weeks of configuration and translation become minutes of conversation. You can finally manage by intent, not by clicks.<h3>The IAMONES Way:</h3>You tell our platform: "Create a temporary role for contractors. They need VPN and read-only access to the 'Project-Alpha' SharePoint site. The role should expire after 90 days."Our conversational AI understands the entities ("contractor role"), the entitlements ("VPN," "SharePoint"), the permissions ("read-only"), and the lifecycle ("expire after 90 days"). It then does the heavy lifting, structuring the logic and configuring the policy in your underlying IGA system.<h3>Stop Working Around the Problem</h3>For too long, the industry's answer has been more training, more consultants, and more custom code to work around the limitations of legacy UIs. That’s like trying to fix a confusing road map by hiring a team of navigators instead of just using a GPS.The technology to bridge the gap between you and your IAM system is here. It’s time to stop blaming the tools and start demanding a better way to control them. The future of IAM is not about replacing your core infrastructure, but augmenting it with the power of language.

IAM is Not Broken. It’s Just Outdated. Let’s Fix It With Language.

Onboarding Process Concept. Business professional illustrating a digital onboarding process with icons for recruitment, onboarding worker management, new employee training, and employee journey.

If you're still onboarding applications into your IAM system with spreadsheets, endless meetings, and manual configurations, we need to have a serious talk. Because that process isn't just slow, it's fundamentally broken, and it's costing you more than you think.For system integrators and IT operations teams, the story is painfully familiar. A new app needs to be integrated, and you're immediately trapped in a cycle of trying to translate complex business needs into the rigid, unforgiving language of your IGA platform. It’s a tedious process that drains time, budget, and morale.<h3>The High Cost of Manual Onboarding</h3>Let's be blunt. This old way of working kills your efficiency and security.<ul><li>Glacial Timelines: What should take minutes stretches into weeks or even months, leaving your business waiting and your IT team bogged down.</li><li>Human Error &amp; Security Gaps: Every manual step is a chance to misconfigure a permission or create a security hole. In IAM, small mistakes lead to big breaches.</li><li>Business Agility Gridlock: In a market that demands speed, the inability to integrate new tools quickly means you’re not just falling behind, you’re holding the business back. </li></ul><h3>The Fix: Stop Translating, Start Reasoning</h3>The solution isn't a better spreadsheet. It’s a complete paradigm shift powered by semantic enrichment: a core capability built into the IAMONES platform today.&nbsp;We use the power of Large Language Models (LLMs) to understand intent and context, just like a human expert would.Instead of manually mapping roles and entitlements, you simply describe what you need in plain English.<h3>The Old Way (Weeks of Pain):</h3>You spend weeks in workshops trying to explain that a "Sales Director" in the new CRM should see all contacts in their region, but only edit the accounts managed by their direct team. Then you cross your fingers and hope the implementation matches the intent.<h3>The IAMONES Way (Minutes to Done):</h3>You tell our platform: "Onboard the new CRM. Grant Sales Directors read-access to all regional contacts and edit-rights only for accounts managed by their direct reports."Our conversational AI parses this, understands the logic, and translates it into the precise technical configuration for your existing IGA solution, whether it's SailPoint, One Identity, OpenText, Saviynt, or another platform. The weeks-long slog becomes a task completed in minutes.<h3>Stop Living in the Past</h3>For the system integrators and IT ops pros in the trenches, this means radical speed, fewer screw-ups, and the ability to supercharge the IGA tools you already own. There's no need to rip and replace.Continuing with manual application onboarding today is like showing up to a meeting with a flip phone. It might technically work, but it sends a clear message: you’re not keeping up. The technology to eliminate this bottleneck is here now. It's time to stop being a translator of business requests and start managing an intelligent, automated IAM ecosystem.

Are You Still Onboarding Apps Manually? Let’s Talk About That…

AI technology concept, Machine Learning, Robot hand touching human hand. to connect with global data refers to how humans can create and control artificial intelligence, AI innovation and technology.

Let's cut through the marketing noise.&nbsp;The term "AI Agent" is everywhere, and frankly, it’s being misused. Many are slapping the "AI" label on the same old workflow automation we've been using for years.&nbsp;For the seasoned IAM professional, this can be confusing and frustrating. You know what a pre-defined workflow is, you’ve built hundreds of them. So, what makes an "AI Agent" any different?Is it just a fancier name for an If-This-Then-That script?No. The difference is fundamental. It’s the difference between a flowchart and a brain.&nbsp;Let's break it down.<h3>Traditional Automation: A Train on a Fixed Track</h3>Think of traditional IAM workflow automation as a powerful, high-speed train. It is incredibly efficient at moving from Point A to Point B along a pre-built track.A human engineer designs the entire track system: every switch, every stop, every connection. The workflow is a rigid sequence of commands:<ul><li>IF a user is created in HR system with title == "Engineer",</li><li>THEN add them to the Engineers-AD-Group,</li><li>AND create a Jira account,</li><li>AND assign the "Developer" role in GitHub. </li></ul>This is powerful and has been the backbone of IGA for years. But it has critical limitations:<ul><li>It’s Brittle: If there's an unexpected obstacle on the track (e.g., the Jira API is down), the train stops. The workflow fails and requires manual intervention. It cannot reason about the problem and find an alternative route.</li><li>It Lacks Context: The workflow doesn't understand what an "Engineer" is or why they need GitHub access. It only follows the pre-programmed rule. If a new type of engineer, a "Data Engineer," comes along, the workflow is useless until a human manually updates the track.</li><li>It's 100% Pre-defined: The entire path is hard-coded. There is no room for dynamic decision-making or emergent behavior. It can only do what you explicitly told it to do.</li></ul>Traditional automation executes a script.<h3>Agentic IAM: A Pilot with a Mission</h3>An AI Agent, in contrast, is like an expert pilot. The pilot is not given a minute-by-minute flight plan. They are given a goal ("Fly from London to New York safely"), a set of tools (the plane's controls, navigation systems, communication radio), and the ability to reason.This is the core of what "agentic" means. It’s a system designed around three pillars: Reason, Plan, and Act.<ul><li>Reason: An AI agent is given a high-level goal, not a rigid script. For example: "Ensure new finance analyst Jane Doe is fully onboarded." The agent understands the intent. It reasons about what "fully onboarded" means for a finance analyst in your organization's context.</li><li>Plan: Based on its reasoning, the agent dynamically creates a multi-step plan. It doesn't follow a pre-built flowchart. It decides what to do on the fly. "First, I need to verify Jane's identity in the HR system. Then, I need to identify the standard set of financial applications. After that, I will need to find her manager for approvals."</li><li>Act (with Tools): The agent executes its plan using a toolkit of functions and APIs. It calls the HR system, queries the application catalog, and interacts with your IGA platform. Crucially, it observes the results. If an API call fails, it doesn't just stop. It reasons about the failure, re-plans (e.g., "I'll try again in 5 minutes and if that fails, I'll notify an admin and proceed with the other steps"), and continues its mission. </li></ul>An AI agent executes a strategy.<h3>Spot the Difference: A Head-to-Head Comparison</h3><table style="border-collapse: collapse; width: 100%;" border="1" data-mce-style="border-collapse: collapse; width: 100%;"><tbody><tr><td style="width: 33.332%;" data-mce-style="width: 33.332%;">Feature</td><td style="width: 33.332%;" data-mce-style="width: 33.332%;">Traditional Workflow Automation</td><td style="width: 33.3359%;" data-mce-style="width: 33.3359%;">Agentic IAM</td></tr><tr><td style="width: 33.332%;" data-mce-style="width: 33.332%;">Driving Logic</td><td style="width: 33.332%;" data-mce-style="width: 33.332%;">Follow a predefined, static script (If-Then)</td><td style="width: 33.3359%;" data-mce-style="width: 33.3359%;">Pursues a high-level goal using dynamic reasoning</td></tr><tr><td style="width: 33.332%;" data-mce-style="width: 33.332%;">Handling the Unexpected </td><td style="width: 33.332%;" data-mce-style="width: 33.332%;">Fails or errors out. Requires human intervention.</td><td style="width: 33.3359%;" data-mce-style="width: 33.3359%;">Adapts and replans. Can handle errors or ambiguity.</td></tr><tr><td style="width: 33.332%;" data-mce-style="width: 33.332%;">&nbsp;Flexibility </td><td style="width: 33.332%;" data-mce-style="width: 33.332%;">Rigid. Any change requires re-engineering the workflow.</td><td style="width: 33.3359%;" data-mce-style="width: 33.3359%;">Dynamic. Can handle new scenarios without being explicitly retrained.</td></tr><tr><td style="width: 33.332%;" data-mce-style="width: 33.332%;">Implementation</td><td style="width: 33.332%;" data-mce-style="width: 33.332%;">A developer codes a visual or scripted flowchart.</td><td style="width: 33.3359%;" data-mce-style="width: 33.3359%;">An admin states a policy in natural language.</td></tr><tr><td style="width: 33.332%;" data-mce-style="width: 33.332%;">Core Question it Answers</td><td style="width: 33.332%;" data-mce-style="width: 33.332%;">&nbsp;"What am I supposed to do next in the script?" </td><td style="width: 33.3359%;" data-mce-style="width: 33.3359%;">"What is the best action to take right now to achieve my goal?"</td></tr></tbody></table><h3>Let's Get Practical: The Access Review Campaign</h3>Imagine a quarterly access review for a critical application.<ul style=""><li>Traditional Automation would execute its script: "Email a spreadsheet of entitlements to all managers. Send a reminder on Day 7. Escalate non-responders on Day 14." If a manager replies to the email with a question like, "What does this permission actually do?", the workflow can't answer. It's a dead end.</li><li>An AI Agent is given the mission: "Complete the quarterly access review for the 'Finance-ERP' application by Friday."<ul style=""><li>It reasons that it needs to contact managers for certification.</li><li>It plans to interact with each manager individually via a tool like MS Teams or Slack.</li><li>It acts, sending a prompt: "Hi Sarah, does Mike still need 'AP-Invoice-Approval' access? He hasn't used it in 92 days."</li><li>If Sarah replies, "Remind me, what is that for?", the agent can query its knowledge base (a tool) and respond: "This permission allows the user to approve invoices up to $10,000."</li></ul></li></ul>This is emergent behavior. The agent didn't have a pre-scripted dialogue. It reasoned about the user's query and used its tools to fulfill the request, keeping the overall mission on track.<h3>The Bottom Line</h3>Don't let the buzzwords fool you. Agentic IAM is not just "smarter automation." It is a fundamental shift from instruction-following to autonomous problem-solving.Traditional automation is a tool to make predictable processes more efficient. An AI agent is a partner to handle the complex, unpredictable, and context-rich reality of modern Identity and Access Management.One follows a map. The other knows how to draw one. Now you can spot the difference.

Agentic IAM vs. Traditional Automation: Spot the Difference

Rocket launch icon soars with speed to hit the growth target. Businessman is touching growing business. Planning and starting corporate business start up, Business goal and investment growth concept.

Let's be honest. The traditional Identity and Access Management (IAM) project is a marathon of frustration.&nbsp;You start with a clear budget and a timeline that seems reasonable, perhaps 12 to 18 months. But soon, you're entangled in a web of endless discovery sessions, custom integrations, and scope creep that leaves your budget in tatters and your go-live date a distant memory.For project managers and buyers, this story is painfully familiar.The promise of IAM is huge: enhanced security, streamlined operations, and rigorous compliance. Yet, the path to achieving it is littered with failed projects that don't meet their original goals, either due to unrealistic expectations or flawed implementation. Some studies indicate that a staggering 50% of traditional Identity Governance and Administration (IGA) projects fail to meet their budget, timing, or functional goals.But what if the problem isn't the goal but the method? What if you could collapse that 12-month slog into a 3-month sprint? The key isn't working harder; it's working smarter by changing the conversation, literally. By shifting from rigid, code-heavy configurations to a dynamic, conversational logic, we can fundamentally accelerate the entire IAM lifecycle.<h3>The Anatomy of a 12-Month IAM Nightmare</h3>Before we fix the problem, we need to face it. Traditional IAM/IGA projects get bogged down for several predictable reasons:<ul><li>Endless Discovery and Customization: Translating complex business policies into the rigid language of an IGA platform is a monumental task. It requires countless hours of workshops to define roles, rules, and workflows, which then need to be implemented through coding. Any misunderstanding or change can set the project back by weeks. Legacy IGA solutions, in particular, often require heavy professional services and customization for every deployment.</li><li>The Integration Black Hole: Your enterprise uses hundreds of applications, from modern SaaS platforms to legacy on-premise systems. Integrating each one is a mini-project in itself, often requiring custom connectors and deep technical expertise. This complexity doesn't just slow things down; it creates a brittle system that's expensive to maintain.</li><li>The User Experience Problem: Most IGA platforms are not user-friendly. When managers are presented with confusing interfaces and lengthy spreadsheets for access reviews, they resort to "rubber-stamping" approvals, which defeats the purpose of the review and introduces risk. Poor user experience leads to low adoption and, ultimately, bad data.</li><li>Rigid and Brittle Workflows: Once a workflow is finally built, it's set in stone. But business needs are never static. A new regulation, a departmental reorganization, or a change in risk posture should trigger a simple policy update. In traditional systems, it often requires a new development cycle, further draining time and resources.&nbsp;</li></ul><h3>The 3-Month Revolution: Enter Conversational IAM</h3>The bottleneck in traditional IAM isn't just the technology but the friction-filled interface between human business logic and rigid system configuration.&nbsp;Conversational IAM, powered by Large Language Models (LLMs), smashes this barrier. It's not about replacing your IGA system but augmenting it with an intelligent, natural language-based layer that accelerates everything.AI assistants are becoming a powerful interface for governing access, offering real-time guidance within everyday workflows. Here’s how this approach tackles the core inefficiencies:<ul><li>From Configuration to Conversation: Imagine defining a complex approval workflow not with clicks and code, but with a simple sentence. Instead of this: Navigating multiple screens to set up a multi-stage approval process, linking approver roles to specific attributes, and defining fallback conditions. You do this: "Access to the 'Financials-Q3' folder requires manager approval first, followed by approval from the Finance Controller if the user is not already in the 'Finance Department' role." An AI agent parses this instruction, structures the workflow, verifies the components (like finding the designated controller), and implements the logic in your IGA system. This turns weeks of configuration into minutes of conversation.</li><li>Simplifying the User Experience: For end-users like department managers, conversational logic is a game-changer. Access reviews are no longer a dreaded chore. Instead of this: A manager receives an email with a link to a portal, where they find a table of 50 direct reports and 500 entitlements to review, leading to certification fatigue. You do this: The manager receives a message via Slack or Teams: "Hi Sarah, it's time for the quarterly access review. Does Mike still need 'write' access to the customer contracts folder?" Sarah can simply reply "Yes" or "No, please revoke."</li><li>Agile and Adaptable Workflows: Business changes happen. With a conversational approach, your IAM system can finally keep up. Instead of this: A new compliance rule (e.g., GDPR) requires a change in how access to EU customer data is approved. This triggers a formal change request, requiring developers to modify and test the existing workflow, taking weeks. You do this: An administrator states the new policy: "All access requests for resources tagged 'EU-PII' must now also be approved by the Data Protection Officer." <h3>A Practical Example: The Access Certification Campaign</h3>Consider a typical access certification campaign, a notoriously painful process for any organization.</li></ul>The Old Way (Weeks to Months):IT administrators manually export user and entitlement data into spreadsheets. Spreadsheets are emailed to dozens of managers. Managers struggle to understand the context, leading to either rubber-stamping or endless follow-up questions. IT manually tracks responses and sends reminders. Finally, IT manually processes the approved revocations. The Conversational Way (Days):A project manager tells the IAMONES platform: "Initiate a certification campaign for all active users of Salesforce. Have their direct managers review their access by next Friday." The AI agent identifies all relevant users and managers, and initiates direct, natural-language conversations in the tool of their choice (e.g., MS Teams). Each manager receives concise, actionable prompts. The system can even provide context, like "This user has not logged into this system in 90 days." The Result: The agent automatically tracks responses, sends intelligent reminders, and escalates non-replies. Upon completion, it generates a full audit report and can automatically trigger de-provisioning actions for revoked access.<h3>Your IAM Project Doesn't Have to Be a Nightmare</h3>For too long, we've accepted that IAM projects are destined to be slow, expensive, and complex. This is no longer true. The immense inefficiency in IAM doesn't come from a lack of powerful tools, but from the archaic, code-based methods we use to control them.By introducing a conversational AI layer, we transform the very nature of interaction with these systems. We empower business users to define their logic and make high-quality decisions without friction. This shift from complex configuration to intelligent conversation is what makes a 3-month IAM project not just a possibility, but a reality.&nbsp;The future of IAM is faster, smarter, and far more intuitive.

Real Talk: Why Your IAM Project Takes 12 Months (and How to Cut It to 3)

iamones

identity & access management

Poppins

Roboto

This website uses cookies. Please refer to the Privacy &amp; Cookie policy for more details.

Blog

How We Engineered IAMONES for EU AI Act Compliance

Your IAM Platform is at a Crossroads: Traditional or Born...

IAM is Not Broken. It’s Just Outdated. Let’s Fix It With ...

Are You Still Onboarding Apps Manually? Let’s Talk About ...

Agentic IAM vs. Traditional Automation: Spot the Difference

Real Talk: Why Your IAM Project Takes 12 Months (and How ...