CONTACT

AI Writes Version One. Who Owns Version Two?

From the CIdO graphic: under the Chief Identity Officer masthead, the headline 'AI writes version one. Who owns version two?' with the second sentence in oxblood, beside a staircase of connector version cards: v1 marked as AI-generated, v2 outlined in oxblood, then v3 and vN as faded dashed outlines. Below the headline: 'A connector is a subscription to someone else's roadmap.'

AI-generated connectors are fast and worth using. They also need documentation many apps don’t have, and they leave the upkeep with your team.

AI has made connectors cheap to write. It hasn’t made them cheap to own.

At EIC in May, Rabobank IAM architect Jos Groenewegen and consultant Dr. Angelika Steinacker walked through an experiment more IGA teams should run. With a standard Claude subscription (about €20 a month), they built four connectors in about six hours: Entra ID over Graph, Salesforce over REST, Slack over SCIM, and Workday over its SOAP interface. In their words, that was “a lot better than our initial expectations.”

Then they were straight about what they’d built. “This was a, well, I’m going to say hobby project.” “We did not go about covering all the edge cases.” And the line I’d put in front of every IGA steering committee: “The human steering remained essential.”

That’s the right read. Two things decide whether your coverage number moves, and AI owns neither of them: what the AI needs before it can start, and who carries the connector once it ships.

Every generator reads the same thing

AI connector generation is spreading fast, and the engineering is good. SailPoint, working with AWS and Claude on Bedrock, cut connector development time “from hours or days to mere minutes” back in 2024. C1 (ConductorOne) says its agent has built “more than 30 production-ready connectors.” I covered Okta’s and SailPoint’s latest moves in my piece on continuous governance. Take the speed. I would.

Then read the input requirements, because they rhyme. C1: “The only prerequisite is solid API documentation.” Oracle, outlining an AI-assisted framework for Access Governance REST integrations in June: “An implementer provides the relevant API documentation and sample payloads”. SailPoint’s generator starts from the application’s OpenAPI or Swagger specification. Whatever the model, the documentation decides whether there’s anything to write.

I call this the documentation tax: an app qualifies for an AI-generated connector only if someone published a usable API and described it well. Plenty of apps pay it. SailPoint argues that SaaS apps with well-documented REST APIs make up “the bulk of the ungoverned long tail.” Maybe so. I haven’t found a published measurement of that split, and we haven’t published one either.

What we can see is where the estate is growing. In Retool’s late-2025 survey of 817 builders, “60% of builders across levels of seniority have built something outside IT oversight in the past year.” Retool sells an app builder, so treat that as directional. RedAccess found roughly 5,000 vibe-coded apps exposing corporate data, and IANS reported that around 40% had “virtually no security or authentication of any kind.” No study I’ve found measures how many of them expose an API or SCIM. My read: few were built with provisioning in mind, and fewer still came with an OpenAPI file for your generator. Your oldest apps, the ones that never had an API, and your newest ones often share the same gap: nothing for the AI to read.

A connector is a subscription to someone else’s roadmap

Salesforce is replacing Connected Apps with External Client Apps, so SailPoint stopped supporting non-ECA authentication for its IdentityIQ Salesforce connector on October 1, 2026. Setups that weren’t migrated “may fail Test Connection, aggregation, and provisioning.” When Microsoft retired Azure AD Graph in 2025, SailPoint warned customers that “no API requests will function” for connectors still pointed at it. Public APIs churn too. In a study of 41,627 APIs whose OpenAPI descriptions were published on GitHub, 24.6% removed operations without first informing their clients.

From the CIdO stat card: 24.6% of 41,627 APIs removed operations without first informing their clients. Source: Di Lauro, Serbout and Pautasso, ECSA 2022, 41,627 APIs with version history mined from GitHub, December 2020 to December 2021.

Those are connectors a vendor maintains, and customers still had to reconfigure them on deadline. The connector your team generated in an afternoon is a different deal. SailPoint’s documentation is blunt about custom code: it “is your own responsibility to create and maintain,” and “custom connectors are not covered by SailPoint Support.” Oracle’s framework likewise leaves the implementer responsible for “reviewing, refining, and approving” what it generates. That’s fair, and it’s how custom code works everywhere.

Can the AI regenerate the code when an API changes? Partly; the SailPoint write-up says parts of it “can be modified or regenerated” when an API’s responses change. Someone still has to notice the break, get access to a test system, update the spec and credentials, re-test, approve, and redeploy. Test access alone is harder than it sounds; one of the EIC speakers noted that “setting up an SAP system is not as easy because I didn’t get a developer license.” In the programs I assess, the IGA team rarely has a pipeline for any of that. It has a backlog.

From the CIdO diagram titled Version one vs. version two: a connector is a subscription to someone else's roadmap. Version one, where AI speeds things up: API documentation, then AI generates the code, then human review, then ship version 1. Version two, which someone has to own every time: an upstream change to authentication or endpoints, then notice the break, get test access, update and re-test, approve and redeploy, and the loop repeats with every upstream change. Sources: SailPoint Developer Community posts on the Salesforce External Client Apps migration and the Azure AD Graph retirement, and SailPoint's custom-connector documentation.

Make it concrete (an illustration, not survey data). Say AI helps your team stand up thirty new connectors this year. Every one of them comes with its own credentials, its own test data and its own vendor release calendar, and your team carries all of it on top of running the IGA platform. I wrote in 2024 that IAM is a continuous effort and that maintenance stays on your budget long after go-live. AI-generated connectors don’t change that; they make it easier to sign up for more of it.

Two questions for any connector plan

StackBob.ai uses AI too, so I won’t tell you to avoid it. Look at the input and the owner instead, and ask two (2) questions of any connector plan, AI-assisted or not:

  1. What does it need before it can start? If the answer is documentation, an API or a SCIM endpoint, you already know which part of the estate it can reach.
  2. Who owns version two? If the answer is your team, budget for it like a subscription, because that’s what it is.

Those two questions are why the market needs an Identity Connectivity Layer, and why we built StackBob.ai. StackBob.ai extends your Identity Governance to applications that lack SCIM, APIs, or connectors, reducing manual provisioning and compliance risks. Your IGA reaches it through its standard, out-of-the-box SCIM connector. Agent Bob, running on No-Code Autonomous Provisioning (NCAP™), learns the target application itself instead of waiting on its documentation. Building, monitoring and maintaining those connections is part of the platform; your team doesn’t carry it. StackBob.ai operates alongside existing IGA and IdP platforms without replacement, migration, or re-architecture.

The RFP checkbox is coming

By the end of 2027, “Can you generate connectors with AI?” will be a checkbox on every IGA RFP, and every vendor will tick it. The question that will separate them is who owns version two. Ask it before you sign anything, AI or not.

References

LinkedIn
Nick Hunt

Nick Hunt

ALL POSTS >

Leave a Reply

Your email address will not be published. Required fields are marked *

Recent posts
Follow us on