AI in the product

AI in Nova IAM: built in and under your control

Nova IAM is an enterprise IGA platform for your entire IT landscape. It uses language models for analyses, suggestions and a chat. AI is off by default, and you decide whether and where a model runs.

Request a demo AI agents and NHI

As of November 2026

Off by defaultNova’s core works without a language model.
Local or cloudAn Ollama endpoint, for example in your own data center, or Anthropic or OpenAI.
Origin in the audit logEntries created through the chat can be filtered by “AI chat”.

Principles

The AI supplements Nova

The core works without AI

Identities, entitlements, requests and approvals, provisioning, reconciliation and recertification make no language model calls. Without AI, only the AI features themselves are missing.
AI suggests, people decide

Analyses, descriptions, role candidates, import parsers and steps for lifecycle routines are suggestions. Entitlements and master data only change once an authorized identity accepts or runs a suggestion.
The chat only acts on your behalf

It works with the rights of the signed-in identity. It only carries out changes after explicit confirmation.

Operating modes

Off, local or cloud

Each identity picks the mode in the page header with the “NOVA-AI” switch. Nova remembers the choice in the browser. If the chosen mode has not been set up, Nova switches to “Off”.

Default

Off

This identity’s requests go to no model. The user interface does not offer it the AI features.
Your endpoint

Local

Requests go to an Ollama endpoint, for example in your own data center. An administrator enters the endpoint URL and the model.
Your API key

Cloud

Requests go to Anthropic (Claude) or OpenAI, optionally through your own base URL. Operations stores the API key as an environment variable on the server. The user interface only shows whether it is set.

Without an API key on the server, Nova rejects every cloud request before data leaves the system. To rule out cloud providers, do not set a key and, if needed, run a model through Ollama in your own infrastructure. For EU data residency, the GDPR mapping recommends local mode.

Features

Where Nova uses AI

Feature	What the AI does	Status
“Nova AI” chat with assistants
Admin Chat	Open to administrators only. It may use all tools, and every change needs a confirmation.	Available
Access Requests	Finds roles and files requests, which then go through the usual approval workflow.	Beta
Help & Navigation	Answers questions and only reads.	Available
Analysis
AI user analysis	Risk assessment, anomalies and a comparison with other identities in the same org unit. Only administrators see and start it, and they can edit and save the result. Nova records every save in the audit log.	Available
AI Healthcheck	19 checks, 11 of them with a suggested fix, run without AI. The suggested fixes come from the check itself, from a fixed catalog. The optional AI layer assesses the findings and explains them in free text. Only the catalog actions can be run, by administrators. The healthcheck has its own AI setting.	Availablesince 2026.08.2
Governance Analyse	Assesses the questions of a questionnaire. Without AI, the questions stay open for manual assessment.	Beta
Roles, reports and data
Role Mining	Nova calculates the candidates for business roles without AI. The AI names, describes and assesses them. Only proposals that administrators accept are applied.	Available
Reports	From a description, the AI generates the queries and the layout of a report.	Available
Migration Workbench	The AI writes the parser for an import file. Dry run, execution and rollback run without it.	Available
Suggestions during setup	The description of a business role, expressions for field mappings, and steps for lifecycle routines assembled from fixed building blocks.	Available
Report a problem	A preliminary check of the report.	Available

Status according to the roadmap and the changelog. Features without an entry of their own there are described as they are in the current product.

Guardrails

Limits the server enforces

The “Nova AI” chat can change data in Nova as well as read it. Nova enforces the limits for this on the server, regardless of which model responds and what it suggests.

Confirmation before every change

The chat does not run tools that change data straight away, whether they create, change, assign, approve, execute or delete something. It first shows the “Confirmation required” card with the action and its arguments.

A confirmation only counts in the immediately following message from the same identity to the same assistant.
Tool and arguments must match the preview exactly. Otherwise Nova asks for a new preview.
The model cannot confirm itself.
Without confirmation, only a few explicitly approved tools run, such as recalculating the dashboard or a dry run of a migration.

Origin in the audit log

Log entries created during a tool call carry a note of their origin. Under “Monitoring › Audit Log”, the “Origin” filter set to “AI chat” shows exactly these entries.

Nova logs what the called endpoint logs, whether the call comes from the chat or from the user interface. It does not write a separate entry per message or per tool call.
Each identity can delete its own chat history. The history is therefore not evidence; the audit log is authoritative.

Only with the signed-in identity’s rights

The chat does not access the database itself. It calls tools, and each tool runs a Nova endpoint in the session of the identity using the chat. Permission checks, validation and logging are the same as in the user interface. Administrators decide for each assistant which tools it may use.

Secrets stay out

No tool accepts passwords, client secrets, tokens or API keys as parameters. Secrets are entered in the user interface. In tool results and previews, Nova replaces such fields with a placeholder.

Data

Which data goes to the model

In local mode, this data goes to the Ollama endpoint you entered. In cloud mode, it goes to Anthropic or OpenAI. If an identity’s switch is set to “Off”, its requests go to no model. The healthcheck has its own setting. To rule out cloud providers, do not set an API key on the server.

Feature	What the model receives
Chat	The messages; name, department, roles, business roles and org units of the signed-in identity; the results of the tools called.
AI user analysis	Name, email, department, location, status and type of the identity; its org units; names and risk of its business roles and entitlements; names and types of the target systems; the number of comparison identities.
Reports	The description, a selected template and the structure of the database tables. In the report dialog, also the column names, row count and first result row of each query after each run.
Role Mining	Names, descriptions and risk of the entitlements, key figures, names of org units and positions. For candidates tied to individuals, also names of identities.
Migration Workbench	An excerpt of the file (its first lines), the chat messages and the result of the last dry run with a selection of rejected records. In cloud mode, this can include personal data from the first lines of the export.
Suggestions during setup	The description you entered; names of the objects a suggestion can refer to, such as entitlements, business roles and org units, and for open requests also the names of the requesters.
Governance Analyse	Questions and target answers of the questionnaire, stored facts about Nova.
AI Healthcheck	Open findings with subject and details.
Report a problem	Description, type of report, current page and an attached screenshot.

If a model does not support tool calls, the chat falls back to a simpler mode. It then sends along a data extract, including the org chart with the names of its members and, in the “Access Requests” assistant, the roles that can be requested.

AI agents as identities

AI features in Nova are one topic, AI agents as identities are another. Since v0.9.4, Nova has managed AI agents as an identity type of their own, alongside people and technical identities. A separate page covers what that includes and where the limits are.

AI agents and non-human identities

Next step

See the AI live on the system.

In a 30-minute video call we show you the AI features for your use cases on the demo system.

Request a demo

Read on

AI agents and NHI
Owner, review and expiry, with limits stated openly.
Usability
How users, approvers, owners and admins work with Nova.
Trust Center
Policies and mappings, including GDPR.
Status & changelog
Every release with its date.