By: Jean Chorazyczewski, InCommon Academy Director
Artificial intelligence (AI) isn’t arriving on campuses through a carefully planned rollout. It is showing up through free tools, personal subscriptions, purchase card charges, and accounts created with institutional email addresses.
People are already using AI. Research and higher education (R&E) Institutions are still determining which tools are approved, what data can go into them, who should have access, what the tools may do, and how to pay for them.
During InCommon’s August IAM Online webinar, “AI in IAM Operations: Use Cases and Governance Lessons,” Curt Herridge and Graeme Varga of Southern Methodist University (SMU), Chris Hyzer of the University of Pennsylvania (Penn), and Sean O’Brien of Internet2 discussed what their institutions are learning as AI moves from individual experimentation toward operational use.
The session surfaced several ideas institutions need to be thinking about now.
Watch the IAM Online
AI Guidance Can’t Wait for Perfect Policy
AI use is moving faster than institutional policy. That doesn’t mean campuses should operate without guardrails.
One approach to AI adoption is to publish practical guidance that can change as the institution learns. Organizing it around real situations, such as teaching, research, intellectual property, data use, and purchasing gives people direction now while formal policy continues to develop.
The larger message: Be a gardener, not a gatekeeper. Find the useful experimentation already happening, make it safer, and “give oxygen” to help the strongest ideas grow.
IAM Turns an Experiment into a Service
It is relatively easy to give a small group access to an AI tool. It is much harder to manage that access once hundreds or thousands of people have personal accounts, different license levels, varying training requirements, and access to different kinds of data.
That is where familiar IAM practices become essential:
- Single sign-on and automated provisioning
- Role- and group-based access
- Training requirements
- Lifecycle management
- Auditing and delegated administration
The experiments reinforced this point: IAM is crucial for scale. Adding it after informal practices have spread is much harder than building it into the rollout.
IAM Context May Matter More Than Code
Interesting results did not come from asking a general-purpose AI tool a general question. They came when AI could work within the context of an institution’s own repositories, configurations, logs, and conventions.
That context helped practitioners:
- Understand unfamiliar technologies more quickly
- Find answers specific to their own environments
- Make specialized knowledge accessible beyond one expert
- Complete work that had been deferred for lack of time
But context also raises the stakes. Institutions must decide what an AI agent can see, what it can do, how its activity is recorded, and where human review belongs.
The emerging pattern: Start read-only, limit authority, preserve existing testing and production controls and best practices, and make access easy to revoke.
What Surprised Our Presenters
- Some reluctant users became the most enthusiastic adopters.
- The understanding was often more valuable than the output. Answers were grounded in local environments, whether the agent analyzed specific codebases to explain database tuning, or scanned live configurations to troubleshoot complex rules when the lead architect was offline.
- People without deep product training could begin doing meaningful work. AI acted less like an autonomous robot and more like a very fast intern — capable, but still in need of direction, review, and testing.
- Long-deferred work finally got done. In one case, AI-assisted monitoring uncovered a real production memory leak.
What Institutions Are Still Working Through
The experimentation is also producing more questions:
- How should an AI agent be identified, scoped, audited, and disabled?
- How does knowledge accumulated in one person’s AI sessions become institutional knowledge?
- How do people learn to recognize a confident but wrong answer?
- What training should be required before an agent receives read/write access?
- How do institutions fund successful pilots and avoid dependence on one vendor?
Learn More
- Register for TechEX 2026, Oct. 26-30 in Minneapolis, Minn.: Enjoy a half-day Grouper MCP workshop, a session on governing non-human identities with midPoint, and our new Community Challenge.
- Join the conversation: NET+ Generative AI Community of Practice
- Suggest a topic for a future IAM Online
