Application onboarding is one of the most time-consuming tasks in identity governance and administration (IGA). Before users can be provisioned or access policies enforced, identity engineers must analyze application documentation, understand APIs, configure schemas, create mappings, and validate connector behavior. Much of this work is repetitive, manual, and requires significant expertise.
The midPilot project was created to change that. Funded by the European Union’s Recovery and Resilience Plan, midPilot explores how artificial intelligence can assist throughout the application onboarding process while ensuring that every important decision remains under human control. With the successful completion of the project’s third milestone in May 2026, we have delivered a functional foundation for AI-assisted application onboarding in midPoint. Rather than building a standalone AI experiment, we integrated intelligent assistant midPilot directly into the midPoint ecosystem through new microservices, connector generation workflows, workflow orchestration, and an integration catalog designed for community collaboration.
Why AI in identity governance and administration requires human oversight
Artificial intelligence can dramatically reduce the effort required to onboard new applications, but identity IGA isn’t a domain where AI can operate without supervision. An incorrect mapping, permission assignment, or provisioning rule doesn’t simply produce an inconvenience – it can create serious security risks, compliance issues, or unintended access to sensitive resources. That is why one design principle guided the entire midPilot project: humans remain in control.
Instead of attempting fully autonomous onboarding, midPilot uses AI to analyze documentation, suggest schemas, generate connector artifacts, draft mappings, and recommend correlations. Expert administrators review every suggestion before it becomes part of a production configuration. This human-in-the-loop model combines AI’s speed with the expertise and judgment of a real human, delivering faster onboarding without sacrificing transparency or trust.
Staying true to Evolveum’s open source DNA, all project deliverables have been implemented in public GitHub repositories. This includes upstream contributions to the main midPoint repository, the integration catalog, the SCIM/REST connector framework, and the dedicated AI microservices. The broader community can immediately access, verify, and benefit from these outcomes.
What we delivered
The true measure of midPilot is the practical value it delivers to identity engineers. By reducing the heavy lifting of documentation analysis, schema preparation, and correlator drafting, we are drastically cutting down manual onboarding effort. To achieve this, we delivered four major technical outcomes.
- A Smart Integration Microservice: Handles schema matching, data mapping, and correlation support while suggesting optimal object and focus types.
- A Connector Generation Microservice: Features session-based discovery, documentation scraping, digestion, and artifact generation.
- Native midPoint Workflow Integration: We built substantial orchestration, validation, persistence, and UI integration directly into midPoint to support smart implementations and connector development.
- The Integration Catalog: A dedicated infrastructure for the publication, discovery, and reuse of integration artifacts. This shifts the ecosystem away from isolated, one-off connector builds toward a collaborative model where configurations can be easily shared and versioned.
How we validated the solution
Building AI features is only valuable if they perform reliably in real onboarding scenarios. Rather than evaluating individual AI models in isolation, we evaluated the complete integration pipeline. Identity engineers ran rigorous end-to-end test scenarios to validate the entire workflow, from providing initial documentation to executing a fully functional connector.
Testing was conducted across diverse, realistic environments, including customer-like proofs-of-concept (PoCs), workshop settings, and Evolveum’s own infrastructure. Using dedicated Docker configurations and SaaS sandboxes, we evaluated the connector generator against both plain REST and SCIM APIs. Tested systems included OpenProject, Codeberg-Forgejo, Nextcloud, Zendesk, and Atlassian, covering full CRUD capabilities for users and groups.
Crucially, these tests proved the effectiveness of our “human-in-the-loop” philosophy. The evaluation mirrored a real-world workflow: engineers provided structured input, reviewed the AI-generated connector artifacts, refined them directly within the midPoint UI, and tested the results. This confirmed that the wizard-based workflow genuinely simplifies and accelerates the authoring process for identity experts.
Looking ahead
With the strong functional baseline established by midPilot, we are shifting our focus from architecture building to consolidation, hardening, and perfecting the user experience. Here is a glimpse into the future of midPoint.
Shifting to a Top-Down, Business-First Approach
Historically, identity integration has been a bottom-up process: administrators configure connectors, map schemas, and handle technical details before ever addressing the business context. We are flipping that script. Engineers will begin by selecting a prepared application from a card-based UI, choosing an integration method, and defining business details (like the application owner and manager) before diving into the technical weeds. If an app isn’t available locally, users will be able to seamlessly recover by browsing the integration catalog.
New Application Dashboards and Setup Assistant
AI is only half the solution; if a user gets lost in the configuration UI, AI suggestions lose their value. To solve this, we are moving away from dense configuration forms and introducing Application and Resource Dashboards. These object-level dashboards will summarize configuration states, integration readiness, and operational signals in one place.
Complementing this is the new Setup Assistant. Adopting a structured two-column layout, the assistant acts as a persistent guide throughout the onboarding journey. It actively bridges the gap between initial app creation and detailed resource configuration, ensuring engineers never have to guess what requires their attention next. (Of course, power users can still configure objects manually whenever they prefer!)
Bringing the Integration Catalog Natively into midPoint
Currently, leveraging the integration catalog involves browsing externally, downloading files, and importing them into midPoint. Soon, we will connect midPoint directly to the catalog. Engineers will be able to browse, download, and deploy community-built integrations natively from the midPoint UI. Furthermore, partners and users will be able to easily upload their own AI-assisted connectors back to the community directly from their environments.
Security by Design: MidPoint Expression Language (MEL)
To guarantee that AI-generated configuration scripts are entirely safe for production environments, we are natively integrating our own strictly controlled MidPoint Expression Language (MEL) into midPilot. This ensures that all AI-generated mapping expressions are secure by design, fundamentally eliminating the risk of unwanted or malicious code injection. You can read more about MEL here.
Updating Our Training and Methodologies
Finally, we want to share everything we’ve learned. We will be updating our midPoint deployment methodologies, certification processes, and training curriculums to include AI-assisted configuration. This will give our users a safe, hands-on tutorial to master AI-assisted connector development and deployment.
Conclusion
The completion of the third midPilot milestone marks an important step toward bringing practical, AI-assisted application onboarding to midPoint. Rather than replacing identity engineers, midPilot is designed to reduce repetitive work by helping analyze documentation, generate connector artifacts, and guide configuration while leaving every critical decision in human hands. As we continue refining the user experience and expanding these capabilities, our goal remains the same: to make onboarding new applications faster, more consistent, and easier to manage without compromising security, transparency, or trust.
Want to explore the project’s architecture, evaluation methodology, and technical findings in more detail? Read the full midPilot report here.
