The Public Sector Case for Repatriating IAM in the Age of AI

## Executive Summary The author argues that in government settings identity is critical civic infrastructure and that relying on external SaaS IAM introduces continuity, accountability, and evidentiary risks—risks that are amplified by AI-driven increases in non-human identities and authorization volume. The piece recommends targeted repatriation of core IAM functions (local policy decisioning, sovereign key custody, token services, and forensic-grade telemetry), treating machine identities as privileged, and operating IAM like a resilient product with SLOs, load testing, and clear operational ownership to ensure deterministic enforcement and auditability.