This would be paired with deterministic controls. So you have, for example, "engineers can only read from the database, and only after they've perform a 2FA" but then there's context like "why is this engineer reading from the payments table when their IP is in a weird location and they're supposed to be on PTO?" and perhaps that's something a model decides.

It's possible to turn that second thing into a sort of "risk score" but it's very hard and a model is going to potentially be better at it.

This is going to make things worse for all kind of use cases that are legitimate but seem non-standard or marginal.

Heck, many websites I visit on the web cannot understand why I, a Ghanaian living in Ghana, might be interested in the service offered or the information therein. I am sometimes blocked for no good reason.

If you are in a third world country, the web is extra hostile. This is going make things worse.

The engineer could be fixing an emergency issue while on vacation. For financial data, that would hopefully be an auto-deny anyway until someone on-site whitelists their IP. And this is if they aren't using VPNs. Adding AI to this party feels like it wouldn't really help.

Non of it really matters if the end product is just going to be ignored because there's zero people who want to be the guard in the panopticon and therefore, it'll still be given to an AI to watch and make it's dumb decisions about how trust worthy you are to do X, Y and Z.

Even if the middle is deterministic, if one end is just going to be lazily hooked up to an AI, it's the shitty dystopian future.

[flagged]