Laravel IAM — AI

AI that assists your access governance — and never holds the decision.

padosoft/laravel-iam-ai is the optional AI module of the Laravel IAM
ecosystem. It adds natural-language explanations, least-privilege suggestions, and access-review
summaries — while making the dangerous half of “LLM + IAM” structurally impossible. Out of the box it
is disabled, the transport is sovereign, and the PDP in
laravel-iam-server remains the sole authority over allow/deny.

The one diagram that explains the whole module

Why this package

Bolting an LLM onto an IAM system is tempting and dangerous: models hallucinate identifiers, leak
secrets into prompts, and — worst of all — get trusted to make the call. This module gives you the
useful half and removes the unsafe half by construction:

“Deterministic first, AI second.” If the AI is off, the transport fails, or the guard rejects the
output, you always get the deterministic answer built from your tools.

What you can do with it

• “Why was I denied?” — turn a terse PDP explanation[] into a clear sentence for a support agent or
  end user, without ever claiming the decision should have been different.
  → Explain a denial
• Draft a least-privilege role — let the AI propose a tightened role from observed usage; a human
  approves it and the PDP enforces it.
  → Draft a least-privilege role
• Summarize an access review — condense a campaign’s signals into a digest for the reviewer — advisory,
  fully audited, with no secrets in the trail.
  → Summarize an access review

Where to start

The Laravel IAM ecosystem

This module is one optional piece of a larger, deterministic IAM platform. It depends on
laravel-iam-server (for the audit recorder) and laravel-iam-contracts, and is never required by them.