Identity governance AI agents

Print / Save PDF

Verified listings tagged for identity governance or access reviews: Lumos Albus, Microsoft Entra Conditional Access Optimization Agent, Opal Paladin, C1 Autonomous Worker (Workday announced an agreement to acquire C1.ai on 13 Oct 2026), Corma AI agents, Cakewalk Agent Cake, Sonrai WALLy and Atomicwork IGA Agent. Fields come from the open dataset (vendor pages, HQ, tasks, published pricing and sources). This is not a ranking or score.

Columns

Lumos Albus and Identity Agent Force (identity governance agents) Microsoft Entra Conditional Access Optimization Agent Opal Paladin C1 Autonomous Worker and C1 Agents (identity governance AI agent, formerly ConductorOne) Corma AI agents (browser-based identity lifecycle, provisioning and access automation) Cakewalk Agent Cake (AI agent for SaaS access provisioning, deprovisioning and conversational access requests) Sonrai WALLy (cloud privileged access management agent) Atomicwork IGA Agent (agentic access provisioning on Atomicwork's AI Workforce)

Hide columns to focus the table. The full comparison stays in the HTML.

Field	Lumos Albus and Identity Agent Force (identity governance agents)	Microsoft Entra Conditional Access Optimization Agent	Opal Paladin	C1 Autonomous Worker and C1 Agents (identity governance AI agent, formerly ConductorOne)	Corma AI agents (browser-based identity lifecycle, provisioning and access automation)	Cakewalk Agent Cake (AI agent for SaaS access provisioning, deprovisioning and conversational access requests)	Sonrai WALLy (cloud privileged access management agent)	Atomicwork IGA Agent (agentic access provisioning on Atomicwork's AI Workforce)
Vendor	Lumos	Microsoft	Opal Security	C1 (ConductorOne, Inc. d/b/a C1)	Corma (Corma SAS)	Cakewalk (Cakewalk Technology GmbH)	Sonrai Security (Sonrai Security Inc.)	Atomicwork (Atomicwork Inc.)
HQ	United States · North America	United States · North America	United States · North America	United States · North America	France · Europe	Germany · Europe	United States · North America	United States · North America
Primary category	Security	Security	Security	Security	Security	Security	Security	Security
Also listed in	Security, Compliance	Security	Security	Security, Compliance	Security	Security, Business operations	Security	Security, Business operations
Summary	AI agent built into the Lumos identity governance platform that designs roles, completes access reviews (approve/flag with peer and usage analysis) and investigates identity risk, explaining every decision.	Security Copilot agent in Microsoft Entra that scans a tenant for users, apps and agent identities not covered by Conditional Access, recommends or updates policies and applies one-click remediation.	AI identity agent in Opal that reviews access requests, investigates context and approves, denies or escalates with recorded reasoning.	Governed AI agent on C1's identity platform that carries out identity work end to end from a plain-language request (revoking stale admin grants, building access reviews, assembling audit evidence on who reached production, finding orphaned entitlement owners), acting only within the operator's own permissions and logging every action.	French identity and SaaS-management product whose custom AI agents automate joiner-mover-leaver provisioning, offboarding and other identity actions in web apps even when no API, SCIM or SAML is available, using a browser-based agent that interprets the admin UI and executes the workflow steps.	Berlin identity-governance vendor's AI agent: once access is approved under the customer's policies, Agent Cake provisions seats in supported apps on the admin's behalf, removes all accounts during offboarding, and lets employees request access conversationally in Slack, inside a platform that discovers apps and AI agents beyond SSO.	Cloud PAM agent that works with Sonrai's Cloud Permissions Firewall across AWS and GCP. WALLy flags identities carrying privilege risk (overpermissioned roles, external accounts with IAM access, unused permissions), prioritises the fixes that cut the most risk, writes remediation policies (quarantine zombie identities, block third-party access, enforce just-in-time access, remove dangerous privileges) and stages them for a human to review and approve before deployment, then confirms the risk is closed.	AI coworker on Atomicwork's agentic ITSM/ESM platform that handles access requests end to end: it reviews context, applies policy, routes approvals to the right owners in Slack or Teams, provisions and deprovisions access and enforces just-in-time access, acting without human intervention unless policy requires it. Listed tools include Okta, Azure AD, Google Workspace, JumpCloud and Microsoft Intune.
Frameworks (vendor-stated)	—	—	—	—	—	—	—	—
Frameworks (vendor-claimed)	—	—	—	—	ISO 27001, SOC 2	—	—	—
Capabilities / tasks	identity governance, access reviews, risk assessment	identity governance, policy management, remediation	identity governance, access reviews	identity governance, access reviews, evidence collection, remediation	identity governance, access reviews, workflow automation, agentic ops	identity governance, access reviews, workflow automation, employee support	cloud security, identity governance, remediation	identity governance, it service, workflow automation
Integrations (vendor-listed)	Not recorded in this dataset yet	Not recorded in this dataset yet	Not recorded in this dataset yet	Not recorded in this dataset yet	Not recorded in this dataset yet	Not recorded in this dataset yet	AWS, GCP	Okta, Google Workspace, Microsoft 365 / Entra, Slack
Pricing (as published)	Not published	No standalone price. Requires Microsoft Entra ID P1 or higher plus Security Copilot security compute units (Microsoft Learn says a run averages under one SCU); Microsoft says Security Copilot agents are also made available to Microsoft 365 E5 customers. Check Microsoft's Security Copilot pricing for SCU rates.	Not published for Paladin.	Not published (two models: SKU-based Platform pricing or usage-based Flex pricing billed in C1 Tokens; amounts by quote).	Published on corma.io/pricing: Freemium (free tier); Essential from €3/user/month; Pro (demo); Enterprise custom from 1,000 users.	Not published	14-day free trial. Cloud Permissions Firewall (which WALLy works with): $15k/year minimum for small cloud footprints; $150 per account per month for 10-50 accounts (AWS, Azure, GCP); 50+ accounts custom. WALLy is not priced separately.	Professional from $25,000/year billed annually (includes 25,000 credits and 2 AI Coworkers, up to 250 end users); additional AI Coworkers $499/worker/month; outcome-based option: access automation $2 per outcome. Business and Enterprise by quote.
Pricing model	quote	quote	quote	quote	published-tiers	quote	published-tiers	published-tiers
Primary source	https://www.lumos.com/products/albus	https://learn.microsoft.com/en-us/entra/security-copilot/conditional-access-agent-optimization	https://docs.opal.dev/docs/paladin/access-request	https://www.c1.ai/news/press-release/c1-launches-c1-autonomous-worker-governed-ai-agent-for-enterprise-identity-work	https://www.corma.io/platform/ai-agent-automation	https://www.cakewalk.security/agent-cake	https://sonraisecurity.com/wally/	https://www.atomicwork.com/features/access-management
Last checked	2026-10-19	2026-10-18	2026-10-18	2026-10-18	2026-10-20	2026-10-21	2026-10-21	2026-10-21
Official site	https://www.lumos.com/products/albus	https://learn.microsoft.com/en-us/entra/security-copilot/conditional-access-agent-optimization	https://docs.opal.dev/docs/paladin/access-request	https://www.c1.ai/products/agents	https://www.corma.io/platform/ai-agent-automation	https://www.cakewalk.security/agent-cake	https://sonraisecurity.com/wally/	https://www.atomicwork.com/features/access-management

Use-case comparisons

• Cloud security (CNAPP) AI agents — 9 listings (Cloud and container security posture, exposure and remediation)
• IT service-management AI agents — 7 listings (IT service desk, employee support and service-workflow automation)

Related

• Lumos Albus and Identity Agent Force (identity governance agents) alternatives
• Microsoft Entra Conditional Access Optimization Agent alternatives
• Opal Paladin alternatives
• C1 Autonomous Worker and C1 Agents (identity governance AI agent, formerly ConductorOne) alternatives
• Corma AI agents (browser-based identity lifecycle, provisioning and access automation) alternatives
• Cakewalk Agent Cake (AI agent for SaaS access provisioning, deprovisioning and conversational access requests) alternatives
• Sonrai WALLy (cloud privileged access management agent) alternatives
• Atomicwork IGA Agent (agentic access provisioning on Atomicwork's AI Workforce) alternatives
• Best security AI agents