Periodic reviews assume access changes slowly enough for humans to inspect it on a fixed schedule. In software-first environments, entitlements, service accounts, and automation identities change continuously, so review campaigns become stale before they finish. Governance has to move closer to the change event if it is to remain effective.