OVERVIEW

Context

This case study covers introducing AI-assisted code generation into IBM Verify, an enterprise identity and access management platform. Verify relies on Common Expression Language (CEL) to define identity logic, attribute transformations, access policies, payload handling  but CEL is difficult to write and maintain, especially for admins who aren't CEL experts.
 

The problem: AI creates a tension between speed and trust: a small mistake can break authentication or open a security gap, and admins stay accountable for whatever logic ships — so blind automation isn't an option.

The challenge: Explore how natural-language prompting could help admins create CEL scripts faster — without stepping outside the constraints of an enterprise security system.
 

"I focused first on aligning the team on the right problem before designing solutions."

Before moving into solutions, I focused on aligning on the right problem and reducing risk early. I work iteratively — observing real constraints, reflecting on tradeoffs, and making focused decisions — while using clear alignment tools to keep the team moving in the same direction. This approach helped us navigate ambiguity early and move into execution with confidence.

 Hills
Clear, human-focused problem statements to align on what actually needed to change before committing to solutions.
 

Playbacks
Regular check-ins to reflect on progress, validate assumptions, and confirm we were solving the right problem, not just shipping features.
 

Sponsor users
Close collaboration with domain experts to ground design decisions in real identity and security constraints.

Meet Scott

Scott works in cybersecurity for a large retail company. He's the Access Management administrator, responsible for the day-to-day tasks that keep the company's infrastructure and apps secure, compliant, running, and useful to others. Most of his day is spent using IBM Verify.

But Scott has a difficult task: he often needs to write CEL to create custom identity attributes, which is like trying to communicate in a country where nobody speaks your language and the only dictionary he can find is incomplete. For Scott and everyone on his team, CEL scripting is really hard.

Understanding the current reality (As-Is)

Before exploring solutions, I focused on understanding how administrators currently create custom attributes and CEL logic in Verify — and where friction, delay, and risk actually occur.

The problem behind the scenes

CEL is hard to learn because it's unique to IBM, with thin documentation and few examples. Admins fall back on old snippets, colleagues, or forums, and even a small mistake can break authentication or create security risk.

"Help identity administrators create correct CEL logic faster, without increasing cognitive load or introducing security risk."

That's the Hill we aligned on, broken into three goals that guide everything from here on:

With a clear Hill in place, I looked at how AI-assisted creation works in other code and logic-heavy tools, not to copy patterns but to see where assistance helps and where it breaks trust.

What we learned Across these tools, three recurring forms of assistance stood out:

• Generation: helping users get started or translate intent into code
• Explanation: making generated or existing logic understandable
• Fixing: supporting correction, refinement, and iteration
  

Notably, tools that leaned too heavily on generation without explanation or control often felt unpredictable or unsafe — especially in more complex or high-stakes workflows

With the problem mapped and a clear Hill in place, I ran a workshop and sketched low-fidelity concepts. CEL has several entry points in Verify, but they all lead into just two surfaces, where I focused early exploration.
  

Clustering workshop ideas into early interaction themes: prebuilt snippets, "make it easy for me," "show me how," "explain it to me," and a side-by-side translator.
 

Each concept varied how and when AI appeared, and how much control users kept. The goal wasn't polish. It was to see which patterns felt supportive versus risky in a security-critical environment.

Before converging on a direction, I validated early concepts with identity admins, not to test UI polish but whether the AI assistance felt useful, trustworthy, and appropriate for a security-critical workflow.

Research objectives:

• How do users (or user proxies) respond to early solution concepts?
• Assess the perceived value of multiple lo-fi concepts with Verify users / internal SMEs
• Understand how the concepts fit real workflows, and surface what's missing

A
Split screen

Offers a clear UX for every need: generate, chat, debug. Tailored to preference, and not distracting.