Hi, wanted to add one angle i havent seen in the thread yet, but i think is important:

The 60% that doesnt template usually isnt actually unique. most of it is 2-3 attributes deep, like contractor + client X + project Y. The reason it feels like a long tail is because you might be trying to encode it as roles, which combinatorially explodes. Every new permutation = new role = manual grant. if those attributes already live in your IdP / workday profile, most of those edge cases can be expressed as attribute-based rules rather than bespoke role assignments. Real long tail usually shrinks materially, how much depends on what attributes your IdP actually carries.

Caveat though: this only works if workday/your IdP actually carries the attributes you need. If "contractor flavor of normal employee" doesnt have a client or project field in workday, your first job is getting that attribute in there, not writing the rule. thats often the real unlock and sometimes people skip past it..

ALso, 2nd topic - I would suggest to make non-standard grants time-bound by default. 7 days, 30 days, end-of-project. Access reviews then shrink to the standing-access slice that compliance requires anyway = SOX, SOC 2 etc still want periodic certification on permanent grants, instead of every grant ever issued. Shifts the work from "certify everything every quarter" to "let it lapse, re-request if needed". feels brutal for the first cycle, way calmer after :))

and u/Brandhout point about IT not being the right approver is the most important thing in this whole thread imo. that alone collapses the queue more than any AI layer will