TL;DR: Access review campaigns often record revocation decisions without fully removing access, because remediation depends on tickets, integrations, and downstream execution, according to OpenIAM’s analysis. The real control failure is not review completion but unverified enforcement, which lets governance evidence outpace the actual access state.
At a glance
What this is: This is an analysis of why access review campaigns can look complete while revoked entitlements still remain active in downstream systems.
Why it matters: It matters because IAM, IGA, and PAM teams need to verify enforcement, not just certification, or they will carry unresolved access risk into audit, compliance, and operational reporting.
Context
Access review remediation is the point where governance intent becomes real access change. In identity governance, that means a manager’s revoke decision must propagate through tickets, provisioning systems, application controls, and directory updates before the entitlement actually disappears.
OpenIAM’s analysis argues that the weakest part of many certification programmes is not the review itself but the handoff from decision to enforcement. That gap is especially visible in complex IAM estates where ownership is split across teams and systems.
For IAM practitioners, the problem is not that reviews are missing. It is that completed reviews can create false confidence when revoked access survives the campaign.
Key questions
Q: What breaks when access review outcomes are not tied to revocation?
A: The control breaks at the point where governance ends and enforcement should begin. Teams may have approvals, timestamps, and audit evidence, but the risky access remains active until someone manually closes the loop. That creates a false sense of compliance while exposure continues in production systems.
Q: Why do access review remediation gaps create compliance risk?
A: Because regulators and auditors care about whether controls work in practice, not only whether the workflow completed. If revocations are recorded but not applied, the organisation can appear compliant on paper while still retaining access that should have been removed. That disconnect is especially serious in regulated environments with sensitive systems and data.
Q: How do you know if your access certification process is actually reducing access risk?
A: Look for evidence that reviews are producing real decisions, not just approvals. Healthy programs show meaningful revocations, fewer stale entitlements, shorter review cycles, and clearer ownership of access decisions. If almost everything is approved, the process is likely measuring completion rather than control effectiveness. The key signal is whether risky or unnecessary access is actually removed.
Q: What should organisations do after a manager revokes access in a certification campaign?
A: They should verify that the revocation reached every downstream system, including directories, SaaS applications, and any delegated provisioning workflow. If the change depends on tickets or manual follow-up, the organisation needs an explicit closure step that confirms removal before the campaign is considered complete.
Technical breakdown
Why certification records do not equal access removal
Access certification captures a decision, not an outcome. Once a manager approves or revokes an entitlement, the governance platform usually records the attestation and closes the campaign, but the actual access change depends on downstream execution. In practice, that means the control has two states: documented intent and enforced state. If teams do not verify the second state, the identity programme can report success while the target application still grants access. This is why review completion is a governance metric, not a security guarantee.
Practical implication: treat certification completion as evidence of review, not evidence of revocation.
How remediation workflows break across IAM and provisioning systems
Remediation often moves through ticket queues, application owners, directory synchronisation, and provisioning connectors before access is actually removed. Each handoff creates a failure point. Manual ticketing adds delay and ownership ambiguity, while incomplete integrations can leave target systems unchanged even when the governance record says access was revoked. Role inheritance and overlapping entitlements make the problem worse because removing one path does not necessarily remove the effective privilege. The result is a remediation gap between the governance ledger and the live access state.
Practical implication: map every revocation path from certification system to target system and confirm which step actually enforces the change.
Why repeated review cycles do not fix enforcement gaps
Increasing review frequency improves oversight, but it does not change the enforcement mechanism. If the organisation still relies on the same ticketing and provisioning flow, more campaigns simply create more revocation decisions that may or may not be applied. That is why certification cadence and remediation reliability are different controls. One measures how often access is assessed, while the other determines whether access is actually removed. When those controls are decoupled, teams can produce better reports without reducing privilege exposure.
Practical implication: measure post-review enforcement success separately from campaign completion rates.
Threat narrative
Attacker objective: The attacker or insider benefits from access that should have been revoked but remains usable in production systems.
- Entry occurs when a user retains access after a certification campaign records a revoke decision but the downstream remediation does not execute.
- Credential or entitlement persistence follows because ticket queues, integration failures, or owner delays leave the permission active in the target system.
- Impact is continued access to systems or data that governance already marked for removal, creating exposure that audit records do not reveal.
Breaches seen in the wild
- Azure Key Vault Contributor escalation 2024: Datadog found Azure Key Vault Contributor could add itself to access policies and read every secret, key and certificate in a vault.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Access review remediation gap is the real control failure: certification proves that a review happened, but it does not prove that access changed. That distinction matters because identity governance often celebrates completion metrics while the operational risk sits in the unresolved enforcement layer. The practitioner conclusion is simple: a review that does not remove access is governance theatre, not access control.
False confidence is created when documentation outruns enforcement: attestation records can be accurate and still misleading if target systems never updated. This is why access governance must be treated as a closed-loop process rather than a reporting exercise. The practitioner takeaway is to measure live access state after every revoke decision, not only whether the campaign closed.
Manual remediation is now the weakest assumption in many IGA programmes: it presumes that a ticket, a queue, and an owner will reliably translate review intent into system change. That assumption fails in multi-system estates because every additional handoff extends the period in which revoked access remains active. The implication is that teams must reclassify remediation reliability as a first-order control, not an operational afterthought.
Revocation without verification leaves entitlement persistence hidden: the permission may be flagged in governance but still survive through directory sync delays, application roles, or overlapping privileges. That is the kind of failure auditors increasingly care about because it shows the programme can produce evidence without reducing exposure. The practitioner conclusion is to treat verification as part of certification closure, not a separate nice-to-have step.
From our research library:
- Over 70% of organisations lack automated access risk analysis, user access reviews and provisioning and deprovisioning, according to Pathlock's 2025 Digital Transformation and Access Risk Report.
- Read next: Access Reviews and Certification Guide
What this signals
Certification and enforcement are different controls: identity governance programmes often optimise for campaign closure, but the operational risk sits in whether revoked access is actually removed from the live environment. Teams should watch for any process where evidence of review is treated as proof of revocation, because that is where access review remediation gaps hide.
Access review programmes need closure criteria that include verification: if revocations are not checked in the target system, the organisation is measuring documentation quality rather than access reduction. That distinction becomes more important as IAM estates span more applications, more owners, and more disconnected enforcement points.
For practitioners
- Verify revocation in target systems Require a post-remediation check that confirms the entitlement is absent in each application, directory, or platform named in the certification decision.
- Track unresolved remediation tickets separately Split campaign completion reporting from remediation closure so delayed or failed revocations remain visible after the attestation phase ends.
- Map every entitlement path before campaign close Identify direct, inherited, and overlapping access paths so a single revoke decision does not leave equivalent privilege behind.
- Confirm integration coverage across target systems Test whether each connected application, directory, and provisioning connector actually receives and applies revocation updates from the governance platform.
Key takeaways
- Access review remediation gaps occur when a revoke decision is documented but the entitlement remains active in the live environment.
- The core weakness is not certification itself but the missing verification that enforcement actually happened.
- Organisations need post-remediation checks and closure criteria that confirm removal across every connected system.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 addresses the attack and risk surface, while NIST CSF 2.0 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-01 — Improper Offboarding | Revoked access that remains active is an offboarding failure in identity lifecycle control. |
| NHI-05 — Overprivileged NHI | Residual access after certification leaves users effectively overprivileged relative to governance intent. | |
| Recommendation — Verify that every revoke decision ends in complete offboarding across all connected systems. Compare certified entitlements with live access and remove any privilege that persists beyond approval. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | The article is about whether permissions are actually removed after access decisions are made. |
| Recommendation — Validate that entitlement changes are enforced in target systems, not only recorded in governance tooling. | ||
| CIS Controls v8 | CIS-5 — Account Management | Revocation failure is fundamentally an account and entitlement lifecycle problem. |
| Recommendation — Use account management controls to confirm revocation and closure across every privileged path. | ||
Key terms
- Access Review Remediation: Access review remediation is the follow-up action taken after an access review identifies excessive, stale, or inappropriate permissions. It includes removing, reducing, or reauthorizing access, then confirming the change was applied correctly so the review produces real risk reduction rather than documentation only.
- Certification completion: The point at which an access review campaign is marked finished because reviewers have submitted their decisions and the governance record is closed. Completion is not the same as enforcement, because the underlying access state may still be unchanged in target systems.
- Verification Closure: The practice of confirming that a governance decision has been applied in the live environment before considering the workflow finished. In access governance, verification closure is what distinguishes documented intent from actual entitlement removal.
- Downstream Enforcement: The point at which identity decisions are actually applied by the systems that host data or services. A central source of truth only provides real control when those downstream systems receive and enforce changes such as revocation, role updates, and entitlement removal.
Deepen your knowledge
NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.
Published by the NHIMG editorial team on July 8, 2026.
Updated on October 11, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org