SailPoint Adds AI-Agent Governance and Real-Time Access Controls to IGA Platform

SailPoint shifts IGA from periodic certification to real-time control

SailPoint announced platform expansions that bring AI-agent identities, machine accounts, and human users under unified governance with real-time policy enforcement. The October 2026 releases — spanning SailPoint Agentic Fabric, SailPoint Human Fabric, and the SailPoint Atlas platform — add AI-agent discovery, just-in-time access provisioning, and separation-of-duties checks that run when access is requested, not weeks later during a certification campaign.

For enterprise IAM buyers, this changes the evaluation criteria. Traditional IGA focused on periodic access reviews and compliance reporting after entitlements were already granted. SailPoint now competes on preventing risky access at request time, positioning against identity-security and privileged-access vendors like Okta, Microsoft Entra ID, CyberArk, and Saviynt rather than only other IGA platforms.

The platform redesign removes record limits and data-processing delays from certification workflows, addressing a longstanding complaint about enterprise-scale access reviews. SailPoint also integrated natural-language access requests through chat tools, reducing friction for end users while maintaining governance controls.

AI-agent governance becomes an explicit buying requirement

SailPoint's AI-agent discovery and governance capabilities reflect a material shift in identity scope. AI agents — autonomous software acting on behalf of users or systems — create entitlements, access data, and trigger workflows without direct human oversight. Most IGA platforms treat these as unmanaged service accounts or ignore them entirely.

Buyers evaluating IGA renewals should clarify whether AI-agent governance, real-time policy enforcement, and temporary access controls are included in existing licenses or require new modules. The likely budget tradeoff is between accepting periodic certification of AI-agent activity and paying for continuous monitoring and just-in-time provisioning.

SailPoint's announcement does not disclose pricing, customer adoption numbers, or independent performance data, so the commercial impact remains unverified. The technical direction is clear, but buyers should demand reference customers with comparable AI-agent volumes and proof that real-time enforcement scales without creating approval bottlenecks.

IdentityIQ 9.0 gives on-premises buyers a hybrid option

SailPoint released IdentityIQ 9.0 with time-based access controls for roles and entitlements, aimed at regulated enterprises that cannot migrate fully to cloud-hosted IGA. The on-premises product adds granular temporal controls, letting administrators grant access for hours or days rather than indefinitely.

This matters for buyers in financial services, healthcare, and government sectors with data-residency or compliance constraints. IdentityIQ 9.0 reduces migration pressure by modernizing the on-premises platform, but it also extends hybrid-architecture complexity. Enterprises running both IdentityIQ and cloud-based SailPoint modules should account for dual-platform operational costs, integration work, and potential policy conflicts between the two environments.

One Identity closes the legacy-application governance gap

One Identity announced a partnership with READI to connect terminal-based, mainframe, and specialized applications to its IGA platform without custom code. The alliance uses READI's Smart Connector technology to bring applications that lack modern APIs or standard connectors under centralized governance.

Most IGA platforms handle SaaS applications well but struggle with older systems. Buyers with manufacturing execution systems, healthcare terminals, financial mainframes, or other legacy environments should evaluate whether packaged connectors can replace custom integration projects. The likely budget comparison is between buying the connector capability and funding professional services to build and maintain custom integrations.

The announcement provides no pricing, customer count, or independently measured reduction in integration time, so the commercial case is thin. Buyers should request proof-of-concept deployments and total-cost-of-ownership data before committing.

Microsoft 365 token-spraying attacks increase authentication urgency

Security coverage during the week reported widespread token-spraying attacks targeting Microsoft 365 cloud accounts for email compromise. The attacks exploit authentication tokens rather than passwords, bypassing basic MFA and password-rotation policies.

Microsoft 365 buyers should prioritize phishing-resistant MFA such as FIDO2 security keys or passkeys, conditional access policies based on device compliance and risk signals, token-lifetime controls, and session-monitoring tools that detect anomalous authentication activity. These controls may shift spending from basic MFA licensing toward identity-threat detection platforms, endpoint integration, and privileged-access management.

The available reporting does not quantify victim counts, financial losses, or Microsoft-confirmed campaign scope, so this is a risk signal rather than a measured incident. It does, however, provide a near-term operational reason to fund authentication upgrades that many enterprises have deferred.

What to watch

The convergence of IGA, privileged-access management, and AI-agent security is accelerating. SailPoint's releases make AI-agent governance and real-time access decisions explicit evaluation criteria for any enterprise IGA renewal. Buyers should demand proof that vendors can discover, govern, and revoke access for AI agents at the same scale and speed as human identities.

Token-spraying activity against Microsoft 365 accounts will likely drive budget toward phishing-resistant authentication and session-risk monitoring. Enterprises that have relied on password MFA should prepare to justify that choice against the cost of a compromise.

For legacy-application governance, the One Identity and READI partnership signals a market opportunity. Buyers with significant terminal, mainframe, or specialized-system footprints should compare packaged connector approaches against custom integration costs and determine whether closing the governance gap justifies the additional platform investment.