Certification breaks at the point where access changes faster than the review cycle can observe it. It can still document accountability, but it cannot guarantee that current entitlements, live sessions, and downstream tokens match policy. That is why organisations need continuous reconciliation for effective access control, not just periodic attestation.
Why access certification loses control authority over live access
access certification is an attestation control, not a real-time enforcement mechanism. It can confirm that someone reviewed entitlements at a point in time, but it cannot stop changes that happen after the review window opens. Once live access is changing through provisioning, role drift, emergency access, session creation, or token issuance, the control is already behind the state it claims to govern.
That is why certification works best as evidence and accountability, not as the main control for operational access. When organisations treat it as the primary control, they confuse after-the-fact approval with current-state control and miss the gap between reviewed access and effective access.
For the underlying mechanics, see IAM and IGA Basics for how access reviews fit into the broader identity governance model, and Access Reviews and Certification Guide for how certification campaigns should be designed to remove access, not merely record that it was seen.
What certification cannot see once access becomes dynamic
The control breaks where entitlement state changes faster than the review cadence. New grants, privilege escalation, temporary elevation, inherited permissions, and hidden paths through groups or delegated roles can all appear after reviewers have already signed off. If the environment also issues live sessions or short-lived tokens, the gap widens because the thing being certified may no longer be the thing actually in use.
This is especially visible in environments with many connected systems, where access is assembled from multiple sources and the effective permission set is only clear when you reconcile the whole chain. A review list may look clean while the live system still contains stale memberships, active sessions, or downstream tokens that preserve access beyond the intended policy.
Continuous visibility becomes the missing control plane, which is why the broader Identity Visibility and Intelligence Platforms (IVIP) Guide is relevant to any team trying to compare reviewed access with effective access, and why the Joiner-Mover-Leaver (JML) Guide matters when change events are the real source of drift.
Why effective access control needs reconciliation, not just attestations
Periodic certification still has value, but only when it is paired with continuous reconciliation that checks current entitlements, sessions, tokens, and downstream authorisations against policy. In practice, that means the access review should be one input to the control system, not the control system itself. If the current state is not continuously compared to the approved state, certification becomes a record of intent rather than a reliable control over use.
For teams managing entitlements at scale, the practical goal is to shrink the time between access change and detection. The shorter that interval, the less a stale review can hide excessive privilege, shared access, or orphaned access paths. This is also where lifecycle management and role discipline matter, because poor upstream governance creates review noise that reviewers will eventually rubber-stamp.
Use NHI Lifecycle Management Guide for the lifecycle dimension of provisioning and deprovisioning drift, and Role Mining and Role Design Guide for reducing role sprawl that makes certification ineffective.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST SP 800-53 Rev 5 sets the technical controls, while ISO/IEC 27001:2022 defines the regulatory obligations.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev 5 | AU-6 — Audit Record Review, Analysis, and Reporting | Supports continuous review of access changes and exceptions. |
| AC-2 — Account Management | Access certification is part of governing account lifecycle and entitlements. | |
| AC-6 — Least Privilege | Live access should be constrained so stale certifications cannot leave excessive privilege in place. | |
| Recommendation — Correlate review outputs with live access changes and alert on drift. Tie certification outcomes to timely removal or adjustment of account access. Limit standing access and require review-backed privilege reduction. | ||
| ISO/IEC 27001:2022 | A.5.15 — Access control | The topic is about controlling who can access what and when reviews stop being sufficient. |
| A.8.3 — Information access restriction | Live access must be restricted according to current policy, not only reviewed periodically. | |
| Recommendation — Define current-state access controls that do not depend on periodic review alone. Enforce current policy restrictions on active access paths and sessions. | ||
Practitioner Guidance
What to prioritise: Treat certification as a validation step after continuous access visibility, not as the primary means of control. The real question is whether you can detect and correct access drift before the next review cycle.
What to verify: Check that your certification workflow compares approved access to live entitlements, active sessions, and issued tokens, and that exceptions are actually revoked or remediated rather than merely accepted.
Common mistake: Teams often measure review completion rates and assume that means access is controlled. High completion with weak remediation is usually a sign of governance theatre, not strong control.
Practitioner takeaway: Certification can prove someone looked, but only reconciliation can prove access is still correct.