The Bots are Coming, So How do We Control Them?

Bots may also be more involved in the actual process of governance itself, for example through bot-facilitated access requests. This would allow for governance controls to be controlled and customised centrally to rapidly meet the needs of the end business user, with little human intervention. The actual process of identity governance would then be improved, just as other activities are seeing the benefit of bot adoption.

Bots as identities

With such a potentially large wave of adoption, the potential for bots to be used without appropriate identity governance is significant. Automation programs that create bots ad hoc, for example, could present a real problem for businesses if they fail to ask the right questions and monitor such programs in the first place. In the face of rushed early adoptions, it’s crucial to ensure that identity standards are being met if businesses want to sustainably stay ahead of the curve.

Despite there being many new and promising bot-based initiatives, the use of models that have already been proven in production is one way to ensure success. Most often, this will mean treating bots in the same manner as contractor-based identities, where a dedicated bot repository is established in the same way it would be if the bot were a contractor. As they are created, modified, or eliminated, this repository must be updated, and that information subsequently brought into the identity governance solution. This also means applying time-based access and the application of policy to ensure tight restrictions on their capabilities within the environment.

Bots need to be controlled in the same way other identities are controlled, meaning that their actions should be confined strictly within set boundaries. Analytics may also be deployed to ensure that they have not been repurposed and are fulfilling their expected function. While one of the greatest benefits of bots is that they allow human effort to be lessened, human oversight of bots is still key to good governance, so every bot must (once again like a contractor) have a real-world person who is ultimately responsible for their governance.

The rapid rise in the use of bots throughout organisations grants identity programs a chance to be enhanced, while also introducing a new class of identities to govern. By being proactive, asking the right questions, and using proven governance models, identity can be utilised to retain governance and oversight while openly welcoming the rapid adoption of this new technology.