People aren't arguing that AI alone makes all the permissions decisions. It's not hard to see a big leap from DLP solutions, which currently already make copious use of machine learning, to permissions auditing, monitoring and recommendations in the first place.