When should organisations prioritise cleanup of unused access over adding more approval steps?

When a large share of access is granted but never used, review friction is no longer the main problem. The bigger issue is standing privilege that continues to exist after need has passed. In that situation, cleanup reduces attack surface faster than adding another layer of approval ever will.

Why This Matters for Security Teams

When access reviews start producing more approvals than removals, the problem is usually not governance fatigue but stale entitlement sprawl. For non-human identities, every unused key, token, or service account is still an active path into systems, even if nobody has touched it in months. That is why cleanup often delivers faster risk reduction than another approval gate.

This is especially true when the organisation already has strong controls on paper but weak lifecycle hygiene in practice. NHIMG’s Ultimate Guide to NHIs notes that 97% of NHIs carry excessive privileges, which means unused access is often also overpowered access. In parallel, the OWASP Non-Human Identity Top 10 treats weak lifecycle control as a core exposure, not a minor hygiene issue.

Security teams should prioritise cleanup when the access inventory is bloated, review exceptions are routine, or privileged entitlements remain active long after a workload changes. In practice, many security teams encounter the breach first and the cleanup backlog only after attackers have already used abandoned access paths.

How It Works in Practice

The decision point is simple: if most access is never used, then the highest-value control is removal, not more approval. Approval steps mainly slow down future requests. Cleanup reduces the number of standing paths that already exist. For NHI programmes, that means identifying service accounts, API keys, tokens, certificates, and workload credentials that are provisioned but no longer exercised by the system they were issued for.

Practically, teams should combine entitlement review with usage telemetry, ownership mapping, and expiry enforcement. Current guidance suggests using short-lived credentials, explicit ownership, and automated revocation where possible. NIST’s NIST SP 800-53 Rev 5 Security and Privacy Controls supports this through access control, account management, and audit logging requirements, while the Ultimate Guide to NHIs — Key Challenges and Risks shows why unused access so often persists unnoticed.

• Start with inventory: find accounts and secrets that have not authenticated within an agreed window.
• Correlate ownership: confirm which workload, pipeline, or integration still needs the access.
• Revoke first, then reissue: remove dormant access before adding another approval layer.
• Move from static to ephemeral where feasible: use TTL-based credentials and rotate secrets automatically.
• Track exceptions separately: if access must remain, document the business reason and review date.

Adding approvals can still be useful for high-risk entitlements, but only after the organisation has removed clearly unused access and reduced the standing-privilege baseline. These controls tend to break down when identity ownership is unclear across shared pipelines because no one can confidently tell whether access is dormant or simply invisible.

Common Variations and Edge Cases

Tighter cleanup often increases operational overhead, requiring organisations to balance faster risk reduction against the possibility of breaking a legacy workload. That tradeoff matters most where systems are poorly documented, credentials are embedded in code, or third-party integrations depend on long-lived access.

Best practice is evolving for environments with autonomous software, agentic workflows, or rapidly changing service topologies. In those cases, adding more approvals may create delay without improving safety, because the access pattern changes at runtime. The stronger pattern is a combination of real-time policy checks, short-lived workload identity, and automatic revocation after task completion. The NHIMG 52 NHI Breaches Analysis and the Microsoft SAS Key Breach both illustrate how long-lived, unused, or forgotten access can become the easiest route for attackers.

There is no universal standard for exactly when to prefer cleanup over approvals, but a practical rule is to clean first when usage is low, ownership is uncertain, or standing privilege is high. Reserve more approval steps for genuinely sensitive access that is still actively used and tightly owned.

Related resources from NHI Mgmt Group

• When should organisations prioritise access visibility over adding more controls?
• When do NHI access reviews create more value than a one-time cleanup?
• Should organisations prioritise external exposure or internal credential governance first?
• Should organisations prioritise just-in-time access over broader GRC automation?