TL;DR: Access certification formalizes who should keep access, who should lose it, and how teams prove least privilege across users, roles, and systems, according to StrongDM. The governance value is real, but manual review cadences, stale inventories, and weak visibility still leave too much room for privilege creep and audit theatre.
At a glance
What this is: This is a practical guide to access certification, showing how periodic and event-driven reviews help prove and enforce least privilege across users, roles, and systems.
Why it matters: It matters because IAM teams need a repeatable control that reduces privilege creep, supports audit evidence, and works across complex hybrid estates, including NHI and privileged access workflows.
Context
Access certification is the recurring governance process used to confirm that a user, role, system, or service still needs the access it holds. In identity programmes, it closes the gap between entitlement issuance and entitlement necessity, which is where privilege creep, orphaned accounts, and audit problems accumulate.
For IAM and PAM teams, the core problem is not whether access was valid once. The problem is whether the organisation can still justify it now, at scale, across changing roles, changing systems, and changing operational risk. That is why access certification sits directly on the control plane for least privilege.
The article treats access certification as a governance mechanism rather than a paperwork exercise. That framing is typical for mature IAM programmes and less common in organisations that still rely on static approvals and informal owner knowledge.
Key questions
Q: What breaks when access certification is not in place for business-critical applications?
A: Without access certification, organisations lose visibility into who has access to what and whether that access is still appropriate. In practice, this leads to access violations, delayed remediation, and weaker evidence for auditors. It also makes it easier for unnecessary privileges to accumulate across departments, roles, and application estates.
Q: Why does access certification matter for least privilege programmes?
A: Access certification matters because least privilege is not sustained by initial approval alone. It requires repeated validation that access still matches role, task, or resource need. Without that recurring decision point, organisations can comply on paper while operational access continues to expand beyond necessity.
Q: How do organisations know if access certification is actually working?
A: Look for shrinking numbers of standing privileges, faster revocation after review decisions, and fewer orphaned or overprivileged accounts over time. If campaigns finish but access sprawl remains unchanged, the programme is producing documentation rather than governance. Working certification changes the entitlement baseline, not just the audit record.
Q: Should organisations prioritise automation or manual access reviews for OT security?
A: Automation should come first for recurring machine connections and vendor access because OT teams cannot sustain manual review of every session without creating friction. Manual reviews still matter for exceptions, critical changes and high-risk links, but the baseline needs continuous control. Otherwise, review cycles will always lag behind the pace of operations.
Technical breakdown
How access certification enforces least privilege over time
Access certification works by re-validating entitlement fit after the original grant decision has aged. That matters because least privilege is not a one-time provisioning rule. It is a lifecycle property that depends on visibility, owner judgment, and reliable revocation when access is no longer justified. Periodic reviews handle scheduled reassessment, while event-based reviews respond to role changes, departures, or compliance triggers. In practical terms, certification is the governance layer that turns access data into an explicit keep, remove, or narrow decision.
Practical implication: treat certification as an entitlement lifecycle control, not as an audit-only reporting task.
Why manual access reviews break down at scale
Manual certification creates decision fatigue when the number of entitlements, reviewers, and systems grows faster than the organisation’s review capacity. At that point, the quality problem is not just speed. Reviewers lose context, stale inventories obscure what is still active, and decisions become checkbox approvals rather than informed governance. Automation can help with routing and evidence collection, but it only works when the underlying rules, system inventory, and access context are accurate. Without that, automation simply accelerates bad review hygiene.
Practical implication: invest in centralized access visibility before pushing review volume into automation.
How centralized visibility changes certification quality
Centralized visibility changes certification from a fragmented approval exercise into a decision system grounded in live entitlement data. When reviewers can see what access exists, where it exists, and why it was granted, they are better positioned to remove unnecessary access and document the decision trail. This is especially important for distributed estates where databases, cloud resources, servers, and privileged tools are reviewed separately today. The technical value is not the dashboard itself. It is the reduction of blind spots that make access reviews unreliable.
Practical implication: build certification workflows around live entitlement context, not around exported spreadsheets.
Threat narrative
Attacker objective: The objective is to exploit excess or stale access before governance catches up, turning forgotten entitlements into a larger attack surface or compliance failure.
- Entry occurs when access is granted for a valid business reason but is never re-certified after the need changes.
- Escalation happens when stale entitlements accumulate into overprivileged users, orphaned accounts, or excessive system access.
- Impact follows when those unused or misaligned permissions expand audit exposure, insider threat risk, and the blast radius of compromise.
Breaches seen in the wild
- BeyondTrust breach 2024: A stolen BeyondTrust Remote Support API key let a China state-sponsored actor reset accounts and reach US Treasury workstations in 2024.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 150+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Access certification is the control plane for least privilege, not a supporting audit task. The discipline only works when entitlement validity is re-checked after business context changes. In mature IAM and PAM programmes, certification is where policy meets actual access state, and that makes it the operational point of control for privilege creep. Practitioners should treat it as a governance layer with enforcement weight, not a reporting afterthought.
Centralized entitlement visibility is the real prerequisite for scalable certification. Review quality collapses when teams cannot see all access paths in one place, especially across cloud systems, databases, servers, and privileged tooling. The article correctly points to live logs and centralized access, because without a complete inventory, reviewers are certifying guesses. The implication is simple: access certification quality cannot exceed access visibility quality.
Manual review cadence alone does not create least privilege. Periodic reviews are necessary, but they do not solve stale access if the data behind the review is incomplete or the decisions are routine approvals. That is why the strongest programmes combine contextual evidence, automated routing, and timely revocation. The control is only effective when it removes access, not when it documents intent.
Privilege creep is a lifecycle failure, not just an entitlement problem. The article’s strongest point is that unused access, orphaned accounts, and misaligned roles accumulate because organisations allow entitlement state to drift away from current need. That drift should be read as an identity governance signal, not a housekeeping issue. Practitioners should measure certification success by how much unnecessary access actually disappears.
Least privilege at scale depends on decision provenance. Auditors and security teams need to know who made the access decision, when, and on what evidence. The article’s emphasis on logs and reporting is correct because certification without defensible decision records becomes audit theatre. The practitioner takeaway is to make every access decision traceable enough to withstand challenge.
From our research library:
- Only 36% of health IT leaders say their organisation applies a privileged access strategy consistently across the enterprise, according to Ponemon Institute research.
- Read next: Privileged Access Management Guide
What this signals
Privilege creep is easiest to hide when entitlement data is fragmented. Access certification programmes only become credible when reviewers can see the full access path, not just the portion owned by one team or one platform. That is why centralized entitlement visibility is the first control boundary to strengthen before scaling review volume.
Least privilege is a living control, not a provisioning checkpoint. Reviews that happen on a schedule but do not remove stale access merely document accumulated risk. The practical shift for identity teams is to connect certification outcomes directly to revocation and to treat failed review as an access-change event, not a report artifact.
Overprivileged NHIs are a certification problem as much as a secrets problem. 97% of NHIs carry excessive privileges, increasing unauthorised access and broadening the attack surface, according to the Ultimate Guide to NHIs. That figure reinforces a broader governance point: review processes must be built for machine accounts, service identities, and human users under the same lifecycle logic.
For practitioners
- Define certification scope by risk and sensitivity Start with the systems, roles, and identities that carry the most business impact if access is wrong. Use resource-based reviews for sensitive data and role-based reviews for broad workforce access where it makes sense.
- Centralize entitlement evidence before review cycles Unify access data from cloud platforms, databases, servers, and privileged tools so reviewers see current access state, not stale exports. That reduces approval noise and improves revocation decisions.
- Tie review triggers to lifecycle events Trigger certification after role changes, departures, compliance cycles, and security incidents so access is re-validated when the business context changes, not only on a fixed calendar.
- Use contextual evidence in reviewer workflows Show last login, business owner, entitlement age, and access path so reviewers can make informed keep or remove decisions instead of clicking through generic approval queues.
- Automate revocation for clearly stale access Where policy is unambiguous, remove access automatically after certification failure or expiry so unnecessary privileges do not survive the review cycle.
Key takeaways
- Access certification is the governance mechanism that keeps least privilege aligned with current business need.
- The main failure mode is entitlement drift, where stale access persists because inventories, reviewers, and revocation do not keep pace.
- The most effective programmes combine live visibility, clear ownership, and automated removal of access that no longer passes review.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 addresses the attack and risk surface, while NIST SP 800-53 Rev 5, NIST CSF 2.0 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-05 — Overprivileged NHI | The article is about proving and enforcing least privilege for non-human and human access. |
| Recommendation — Review NHI entitlements against least privilege and remove access that no longer has a business justification. | ||
| NIST SP 800-53 Rev 5 | AC-6 — Least Privilege | Access certification is the practical control used to validate least privilege across entitlements. |
| Recommendation — Use AC-6 to scope access to the minimum required and certify exceptions on a recurring basis. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | The article focuses on managing entitlements and authorizations through review and remediation. |
| Recommendation — Map review cycles to PR.AA-05 and verify that entitlements remain aligned to current job or task need. | ||
| CIS Controls v8 | CIS-5 — Account Management | Certification is a core account management process for removing stale or misaligned access. |
| Recommendation — Apply account management controls to recertify access and revoke unnecessary accounts and entitlements promptly. | ||
Key terms
- Access Certification: Access certification is the periodic review of whether an identity still needs its current entitlements. For NHIs, certification is only reliable when reviewers know the identity's owner, purpose, and expiry, otherwise stale machine access can persist long after the original use case has ended.
- Privilege Creep: Privilege creep is the gradual accumulation of access rights beyond what an identity actually needs. It usually happens when permissions are added for convenience and never removed. For NHIs, privilege creep expands blast radius and makes old credentials far more dangerous than their original purpose suggests.
- Entitlement Inventory: A complete record of what a user, vendor, service, or device can access across applications and environments. Without it, offboarding becomes guesswork because teams cannot reliably revoke what they cannot see.
- Reviewer Fatigue: Reviewer fatigue is the point at which decision-makers are given too many low-context access records and begin approving by default. It is a process design failure, not a character flaw. In practice, it is caused by volume, poor enrichment, and interfaces that make careful judgment slower than rubber-stamping.
Deepen your knowledge
NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.
Published by the NHIMG editorial team on June 8, 2026.
Updated on October 7, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org