Conventional Identity and Access Management (IAM) systems depend on static, rule-based policies that cannot adapt to the pace and sophistication of modern cyber threats. This paper presents an artificial intelligence (AI)-driven framework for continuous identity risk assessment and adaptive access control, integrating autoencoder-based anomaly detection, Bayesian probabilistic risk scoring, and a Q-learning reinforcement learning agent for real-time access policy adjustment. It is further augmented by graph-theoretic centrality analysis to elevate the risk priors of structurally privileged accounts within the enterprise permission network, ensuring that high-exposure identities receive proportionately heightened scrutiny. The framework is evaluated against a concretely defined three-rule static IAM baseline using logon event data drawn from the publicly available Computer Emergency Response Team (CERT) Insider Threat Dataset (release r4.2), a peer-reviewed benchmark published by Carnegie Mellon University’s Software Engineering Institute (SEI), where a stratified subsample of 5000 logon events (preserving the dataset’s empirically observed anomaly prevalence of approximately 3%) is partitioned using a 60/20/20 train/validation/test split, with all reported metrics computed exclusively on the held-out test set ($n = 1{,}000$ events). On the test set, the proposed framework achieves 95% classification accuracy against 85% for the static baseline, reduces the false-positive rate from 18% to 3%, lowers mean response latency from 45 s to 15 s, and attains a generalisation error of 6% under mild distributional shift, compared with 18% for the baseline, demonstrating that an integrated AI-driven IAM pipeline can substantially outperform static rule-based approaches under controlled benchmark conditions.