An on-demand access review is a certification launched in response to a specific event, such as a role change, privilege escalation, or termination. It replaces purely calendar-based recertification with a decision made close to the time risk changes, which makes the governance signal more accurate and operationally useful.
Expanded Definition
On-demand access review is a risk-triggered certification process used in NHI governance when the security posture of a service account, API key, token, or agent changes materially. Rather than waiting for a quarterly or annual cycle, the review is launched when an event changes the trust decision, such as privilege escalation, role reassignment, ownership transfer, offboarding, credential rotation failure, or abnormal tool access. In practice, this makes the review closer to the actual risk moment and more useful for OWASP Non-Human Identity Top 10 style governance controls.
Usage in the industry is still evolving. Some teams treat on-demand review as a security approval checkpoint, while others treat it as an audit event that records whether access should remain in place. NHI Management Group recommends the narrower interpretation: the review should drive a concrete retain, reduce, or revoke decision, with evidence tied to the trigger. That distinction matters because NHI access often changes faster than calendar governance can react. The most common misapplication is using on-demand review as a paperwork exercise after the access change has already been accepted and operationalised.
Examples and Use Cases
Implementing on-demand access review rigorously often introduces workflow friction, because business continuity and security teams must weigh speed of response against the cost of interrupting active automation and agent execution.
- A platform team grants an AI agent elevated database permissions for a migration, then launches an immediate review once the migration completes to decide whether the extra privilege should be removed.
- A service account owner changes teams, triggering a review of all inherited API keys and cloud roles before the ownership handoff is accepted.
- A secrets manager rotation fails for a high-value token, so an on-demand review is opened to confirm whether the token should remain active or be revoked and replaced.
- An offboarding event is detected in an identity workflow, and all NHI entitlements tied to that employee’s automation assets are reviewed for orphaned access.
- A security incident reveals unexpected tool access by an agent, prompting a targeted review of command scope, data sources, and approvals against the NHI Lifecycle Management Guide.
For broader context on real-world NHI failure modes, see the 52 NHI Breaches Analysis and the control expectations in NIST SP 800-53 Rev 5 Security and Privacy Controls.
Why It Matters in NHI Security
On-demand access review matters because NHI risk is highly dynamic: privileges expand, tokens persist, and ownership changes often happen faster than a scheduled recertification can catch them. When reviews are tied to events, organisations are more likely to catch standing privilege, stale entitlements, and orphaned credentials before they become persistent exposure. This is especially important where automation, CI/CD, and agentic workflows can amplify a small access mistake into repeated unauthorized actions.
NHIMG research shows that 97% of NHIs carry excessive privileges, making timely review a practical control rather than a compliance checkbox, and the same body of research shows that only 20% have formal processes for offboarding and revoking API keys. Those conditions make event-driven review far more relevant than routine calendar campaigns for many environments. It also supports stronger governance by aligning access decisions to actual change events, not assumptions about stability. The related guidance in the Ultimate Guide to NHIs highlights why delayed remediation leaves risk in place long after the trigger has occurred.
Organisations typically encounter the need for on-demand access review only after a role change, breach, or failed automation reveals that access remained in place longer than intended, at which point the review becomes operationally unavoidable to address.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 address the attack and risk surface, while NIST CSF 2.0, NIST SP 800-63, NIST Zero Trust (SP 800-207) and NIST AI RMF set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-02 | Covers excessive privileges and review-driven reduction of NHI access. |
| NIST CSF 2.0 | PR.AC-4 | Least privilege and access governance depend on timely entitlement review. |
| NIST SP 800-63 | Identity assurance depends on keeping authenticators and bindings current after changes. | |
| NIST Zero Trust (SP 800-207) | PA-2 | Zero Trust requires continuous reassessment of access as trust conditions change. |
| NIST AI RMF | GV.3 | AI governance requires operational review of access linked to system changes and risk. |
Tie AI agent access reviews to change events and document the resulting risk decision.
