As part of our ongoing commitment to providing you with additional opportunities to benefit from the insights and expertise of InCommon Catalysts, we are continuing their quarterly Q&A column, Catalyst to Catalyst, which we feature in our e-newsletter InCommon News.
Think of Catalyst to Catalyst as a quarterly, virtual advice panel providing perspectives on key identity and access management (IAM) topics for the InCommon community. In this installment, catalysts discuss the importance of the Internet2 Community Exchange as well as how research and higher education institutions can leverage AI or analytics to improve identity governance. This is our first column for 2026.
Why is CommEX26 an important gathering for the research and education community?
Response: In higher education, the hardest technology problems are often shared across campuses nationwide. In my work supporting universities with identity and access management (IAM), I see institutions trying to move faster on digital transformation while also strengthening security and maintaining equitable access for students, faculty, visiting researchers, affiliates, third-party partners, and more. When identity is messy, everything downstream becomes harder to fix.
That’s why the 2026 Internet2 Community Exchange (CommEX26) is such an important gathering for the research and education (R&E) community. Internet2 describes CommEX26 (being held in Chicago, April 13-16, 2026) as the place where IT leaders and their teams come together to shape the future of R&E technology through strategic discussions and community-driven problem solving. It is one of the few convenings where campuses can come together to discuss durable patterns the sector can reuse.
CommEX26 is especially valuable because IAM is about far more than technology alone. IAM sits at the intersection of security, policy, governance, and user experience. The hardest IAM questions are often how an institution will balance security with usability.
A workshop or hallway conversation with peers who have already lived through a messy technological overhaul can provide practical guidance that is difficult to get anywhere else. The Internet2 program is explicitly built by the community, for the community, with sessions and events designed to generate and share knowledge.
CommEX26 also highlights the importance of thinking beyond the urgent.The future is not every campus solving issues from scratch. Community-driven solutions and reusable practices will accelerate progress across higher education. CommEX26 is a concrete place for those shared answers to begin taking shape.
—Giselle Martinez, Senior IAM Consultant, Moran Technology; martinez@morantechnology.com
How can research and higher education institutions leverage AI or analytics to improve identity governance?
Response: AI is rapidly becoming a practical tool for improving identity governance, particularly in research and higher education (R&E) environments where complex access policies and distributed administration are common. Within the InCommon Trusted Access Platform (ITAP), we are seeing multiple approaches applying AI to these challenges.
For midPoint, the primary ITAP identity governance and administration platform, Evolveum has announced the midPilot project. MidPilot is an AI-powered assistant designed to speed up application onboarding, enhance visibility, and strengthen security by reducing the attack surface through proactive identity governance. Funded by the European Union’s Recovery and Resilience Plan, Evolveum recently announced that the second milestone in the project has been reached, delivering minimum viable products for connector generation, model-mapping recommendations, and correlation analysis. Evolveum’s chief product officer, Pavol Mederly, recently presented midPilot’s progress at the Gartner Identity & Access Management Summit in London.
There have also been great strides to incorporate AI tools within Grouper, the ITAP group and access management platform. Last year two independent external model context protocol (MCP) servers for Grouper demonstrated the value of natural-language tools for interacting with the platform for both administrators and help desk staff alike. In response, Grouper developers have now integrated an MCP server directly into the latest release. Incorporating an MCP server directly into Grouper enables fine-grained security controls, enforced through system level and OAuth scoping. It also allows for detailed event audits of AI tool executions. MCP support is not the only AI initiative from the Grouper team. They also maintain three public GPT models trained on Grouper documentation and usage patterns. One for general assistance, one for developing web service calls, and one for assisting with GrouperShell (GSH) scripts. They also demonstrated AI integration with internal GSH templates at the 2025 Internet Technology Exchange and provided documentation for implementing similar workflows. Finally, the Grouper community continues to explore new AI integrations through active collaboration in a public Slack channel dedicated to the topic.
—Jim Beard, IAM Engineer, Unicon, jbeard@unicon.net
Response: Identity governance in higher education is hard. Not just hard in a “we just need better tools” way but hard in a structural way. Universities and research institutions manage some of the most diverse user populations of any sector: students who arrive and leave every semester, faculty with dual roles, researchers who need temporary access to sensitive systems, collaborators from partner institutions, contractors, visiting scholars, and emeritus faculty who probably still have accounts from 2009 (but nobody is sure).
The result is predictable. Access rights accumulate. Roles drift. Orphaned accounts pile up. Deprovisioning falls behind. And somewhere underneath all of it is a compliance obligation: FERPA, HIPAA for research, export control, and sponsored project requirements, etc. All items for which someone needs to be able to account. AI and analytics do not solve this problem. But they can make the people working on it significantly more effective.
Making RBAC actually work: Role-Based Access Control is one of those things that sounds clean on a whiteboard and gets messy fast in practice. Most institutions I have worked with have role models that made sense when they were designed and have since been patched, extended, and generally added to until nobody fully trusts them anymore. AI-driven role mining can help untangle this by analyzing actual access patterns across the user population; who has what, what is being used, where permissions cluster naturally, and surfacing role structures that reflect how the institution actually operates.
For higher education specifically, this matters because the user population is genuinely complex. A graduate teaching assistant who also runs lab experiments has a different access profile than a tenured professor and trying to map that manually is just slow and error prone.The goal is not to automate governance decisions. It is to give the people making those decisions better data to work from.
Provisioning, from reactive to something better: Most provisioning in higher education is reactive. An event happens; someone submits a request; access gets granted. Usually on a reasonable timeline, occasionally not. Deprovisioning is often worse. Access that should have been revoked often is not because the trigger did not fire; the ticket did not get submitted, or the process broke down somewhere.
Analytics can help fix this by integrating identity governance with the authoritative systems that already know what is happening (the student information system, HR, grant management, research computing) and using that data to drive access workflows automatically. Also, on the deprovisioning side: dormant accounts, access tied to expired projects, entitlements that no longer match someone’s current role; these are all detectable. You do not need a manual review cycle to find them. You just need the system to be paying attention.
Access certification that is not just a formality: The annual access certification campaign is maybe the most universally acknowledged governance fiction. Managers get a spreadsheet; they click approve on things they do not have time to actually evaluate, and everyone moves on. It produces a paper trail, but I am not sure if it produces much else. AI changes the equation here by prioritizing certifications based on actual risk signals: permissions that have never been exercised, access that deviates from peer groups, entitlements spanning systems in combinations that suggest something worth looking at. Instead of asking a reviewer to evaluate five hundred entitlements, you surface the thirty that are actually anomalous and give the reviewer context for why. That is a review process someone can actually do thoughtfully.
For institutions managing federally funded research data, this kind of continuous, risk-prioritized certification is increasingly what sponsors and auditors expect to see. A once-a-year checkbox is not really enough anymore.
Where to start: If I am being practical: start with data quality. AI models are only as good as the identity data underneath them, and most institutions have that data scattered across systems that do not talk to each other particularly well. Getting a clean, unified view of who is who across HR, student, and research systems is foundational, and it is worth doing regardless of what you build on top of it. Over the last two decades, nearly all of my IAM projects have involved significant data cleanups.
From there, focus on use cases with clear, measurable value first. Automated deprovisioning workflows are a good early win; they are relatively straightforward to implement, and they produce results you can actually show someone.
And keep humans in the loop. The institutions that get the most out of AI in identity governance treat it as decision support. AI surfaces the signals; your governance practitioners interpret them and own the outcomes. That is not a limitation; that is probably how it should work.
—Mark Earnest, COO & Co-Founder, Instrumental Identity; mark@instrumentalid.com
