Because they evaluate permissions in isolation while risk is created by combinations. A standard-looking entitlement can become powerful when paired with nested groups, delegated control, or access in another system. The issue is not always bad data. It is that the review model is too narrow to show how authority actually behaves.
Why standard access reviews miss combination risk
Traditional access reviews are usually built to confirm whether each permission looks acceptable on its own. That model works for simple entitlements, but it misses the way risk emerges when several ordinary-looking permissions interact. A review can therefore pass an account that becomes dangerous only when nested groups, delegated administration, or cross-system access are considered together.
That is the core blind spot: the review is checking items, while the real control problem is the effective authority created by combinations. In practice, the question is not just “does this user have access?” but “what can this access become when joined with other access paths?”
Why combinations change the answer
A single entitlement may look harmless because it does not obviously expose a sensitive system or action. But permissions accumulate through group nesting, inherited roles, app-specific privileges, token scopes, and delegated control. Once those pieces are combined, a reviewer may miss that the account can approve its own requests, alter the records that justify access, or reach a second system that turns read access into operational power.
Access reviews also tend to be bounded by the source system they are running in. That creates a narrow lens: the reviewer sees one directory, one application, or one role catalog, but not the end-to-end authority chain. The result is false confidence, because the access appears compliant in one system while the effective blast radius is created elsewhere. IAM and IGA Basics is useful here because it explains why authorization, entitlement governance, and access review are related but not identical problems.
Nested groups and delegated control are especially important because they hide privilege behind indirection. A reviewer may see a low-risk group membership and miss that the group inherits a privileged role three layers down. Likewise, cross-system access often matters more than the permission itself: a harmless-looking export right in one platform may become powerful when paired with administrative access in another. Role Mining and Role Design Guide helps with this because role structure is often where hidden combinations are created. Privileged Access Management Guide is also relevant because delegated and standing privileges are common sources of combination risk.
What good reviews do differently
Effective reviews shift from entitlement-by-entitlement checking to context-aware evaluation. They ask whether the access is standalone or cumulative, whether it can be chained with other rights, and whether it changes the decision boundary in another system. That means looking at role inheritance, group nesting, administrative delegation, service or shared accounts, and any access path that can amplify the original permission.
Good practice also includes reviewing toxic combinations directly, not just the components. If a user can both request and approve access, administer and audit the same environment, or combine a non-sensitive permission with a second permission that unlocks a restricted action, the issue should be flagged as an effective access pattern rather than a checklist item. Segregation of Duties (SoD) Guide is a strong fit for this because it addresses conflicting permissions and toxic combinations, which is exactly where isolated review models fail. Access Reviews and Certification Guide is also directly relevant because it focuses on making certification campaigns more risk-aware and less like rubber stamping.
Another improvement is to review access against business function, not just system entitlement. If the same person can influence data, controls, and approvals in separate tools, the combination may create fraud, override, or segregation failure even though no single grant looks excessive. The practical test is whether removing one access item meaningfully reduces authority, or whether the true risk sits in the relationship between several items that were never evaluated together.
Risk and Threat Considerations
Combination risk creates a false negative problem: the review passes the account, but the effective privilege remains high enough to support misuse, fraud, lateral movement, or unauthorized change. The threat is amplified when attackers can inherit access through nested groups, abuse delegated administration, or pivot through a second system that was not included in the review scope.
Failure mechanism: The review model evaluates permissions as independent records, so it misses inherited authority, cross-system chaining, and toxic combinations that only become visible when access paths are assembled into a single picture.
Impact: Excessive or conflicting access can survive certification, leading to privilege escalation, control bypass, self-approval, or silent access expansion that looks compliant on paper but is operationally risky.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 addresses the attack and risk surface, while NIST SP 800-53 Rev 5 sets the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev 5 | AC-6 — Least Privilege | Combination risk often reflects excessive effective privilege across linked access paths. |
| AC-5 — Separation of Duties | Toxic combinations are a classic separation-of-duties failure in access reviews. | |
| IA-5 — Authenticator Management | Cross-system access often depends on credentials, tokens, or shared secrets that extend authority. | |
| Recommendation — Review effective access paths and remove permissions that create unnecessary cumulative authority. Check that no single identity can complete conflicting actions or approve its own access. Track and rotate credentials that let one access path amplify another. | ||
| OWASP Non-Human Identity Top 10 | NHI-05 — Overprivileged NHI | The question’s risk pattern includes excessive effective privilege across machine or service access. |
| NHI-08 — Environment Isolation | Cross-system combinations become dangerous when access crosses boundaries that should remain separate. | |
| Recommendation — Audit non-human access for cumulative privilege, not just single-system entitlements. Enforce boundary separation so access in one environment cannot expand into another. | ||
Practitioner Guidance
What to prioritise: Review effective access paths first, not just raw entitlements. Start with roles, nested groups, delegated admins, and shared or service accounts, because those are the places where combinations most often hide higher privilege.
What to verify: Confirm whether any access grant can influence its own approval, override another control, or combine with a second system to create materially stronger authority. If the answer requires joining data from multiple systems, the review process needs that join, not a narrower checklist.
Common mistake: Treating “no single permission is risky” as proof that the account is safe. A combination can be the risk even when each individual item looks routine.
Practitioner takeaway: Access reviews fail when they certify pieces instead of authority. The control should answer how access behaves in combination, not whether each entitlement looks acceptable in isolation.
Related resources from NHI Mgmt Group
- How should security teams run access reviews for non-human identities?
- When do NHI access reviews create more value than a one-time cleanup?
- Why do traditional access reviews miss non-human identity risk?
- How should security teams uncover toxic access combinations across ERP and identity systems before quarterly reviews miss them?