Automating user access reviews for least-privilege at enterprise scale

At a glance

What this is: This is a Delinea blog analysis arguing that user access reviews have become too large and too manual for hybrid enterprises, and that automation is now necessary to preserve least-privilege control.

Why it matters: It matters because IAM, IGA, and PAM teams need access certification processes that actually complete remediation, support audit evidence, and cover human and non-human access at modern scale.

By the numbers:

• For example, Norwegian Cruise Line Holdings had 450 unique reviewers, 14,000 users, and approximately 300,000 lines of access across its in-scope SOX applications.
• Across customer interviews, Fastpath reduced time spent on access reviews by up to 80%, with some customers reporting savings of 120 hours per quarter.

Context

User access reviews, also called access certification campaigns, are the periodic checks that determine whether access still matches job needs. In this article, Delinea argues that the control is still essential, but the scale of modern enterprise environments has made manual execution too slow and too error-prone for reliable least-privilege governance.

The governance gap is not the concept of review itself but the operating model around it. As organisations add on-premise, cloud, SaaS, machine identities, APIs, and AI agents, the reviewer workload expands while the evidence standard for compliance and audit remains unchanged.

That makes access certification a lifecycle problem as much as a review problem. The article positions automation as the mechanism that keeps review, routing, remediation, and documentation aligned with enterprise identity sprawl.

Key questions

Q: What breaks when user access reviews are still manual in hybrid environments?

A: Manual reviews break when reviewers cannot reliably see all active entitlements across cloud, on-prem, and third-party systems. The result is incomplete certification, stale access that survives role changes, and weak remediation evidence. In practice, the review process becomes too slow to reflect how quickly modern permissions drift.

Q: Why do automated user access reviews matter for least privilege?

A: Least privilege decays over time as roles change and temporary access is never fully cleaned up. Automated certification helps restore the intended access boundary by making reviews, routing, and remediation continuous enough to catch drift before it accumulates into compliance and fraud risk.

Q: What are the signs that an access certification campaign is failing in practice?

A: A campaign is failing when reviewers are working from stale data, the review window is too vague, or the process becomes so frequent that people stop giving it proper attention. Other warning signs include unclear objectives, inconsistent ownership, and responses that cannot be acted on because the evidence is incomplete. Those conditions make the results misleading instead of usable.

Q: How should organisations implement ISO 27001 access reviews across human and machine identities?

A: Treat the review as a control check over current entitlements, not a workflow approval. Pull together human users, service accounts, tokens, and application access into one evidence set, then require an owner to confirm business need, privilege scope, and removal date for each entry.

Technical breakdown

Why manual user access reviews break at scale

Manual access reviews depend on people extracting access data, formatting it, routing it, chasing responses, and validating removals. That workflow can work when the environment is small, but it collapses under hybrid estates where entitlements live across ERP, SaaS, legacy platforms, and multiple role models. The failure is not just effort. Manual handling increases the chance of missed entitlements, misrouted reviews, stale evidence, and delayed remediation. In governance terms, the control becomes intermittent rather than continuous. Practical implication: treat spreadsheet-driven certification as a scaling bottleneck, not a control objective.

Practical implication: replace manual extraction and routing with automation before review volume outpaces evidence quality.

How automation changes access certification mechanics

Automated user access reviews connect directly to source systems, pull entitlement data, assign the right reviewer based on attributes or role ownership, and track completion through a central workflow. The important technical shift is that the system manages the control lifecycle rather than just the reviewer experience. That includes reminders, delegation handling, and validation that a rejected entitlement was actually removed in the source system. Without that last step, the review may be complete on paper but not in reality. Practical implication: automate review, remediation, and validation as one control chain, not three separate tasks.

Practical implication: require source-system remediation validation, not just reviewer approval, before closing an access review cycle.

Why least privilege now depends on certification workflows

Least privilege is not enforced once at provisioning; it decays over time as roles change, access is added for temporary reasons, and accounts remain active after business need shifts. User access reviews are the periodic mechanism that restores the intended access boundary. In environments that include machine identities and AI agents, the same logic applies, but the review data needs enough context for a reviewer to judge whether access still belongs. That means identity context, application context, and entitlement context. Practical implication: build access certification around lifecycle drift, not just quarterly compliance dates.

Practical implication: give reviewers enough identity and application context to decide whether access still matches business need.

Breaches seen in the wild

• Kubeflow cryptomining attacks 2020: Exposed Kubeflow dashboards and a notebook's mounted Kubernetes service account let attackers run cryptominers on tens of ML clusters.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Access certification is now a lifecycle control, not an audit ritual: The article shows that periodic review still matters, but the old manual model no longer fits the volume and variety of enterprise identities. When human users, machine identities, APIs, and AI agents all sit inside the same access estate, the control has to govern continuity, not just compliance evidence. The practitioner conclusion is that review programmes must be designed as ongoing entitlement governance.

Manual certification creates governance drift even when the policy is sound: The weakest point is not the principle of least privilege but the operational path from reviewer decision to actual removal. If access is approved or denied in a spreadsheet and the source system is not updated reliably, the organisation keeps the risk while claiming the control. The practitioner conclusion is that remediation validation is part of the control, not a follow-on task.

Machine identities and AI agents widen the access-review problem beyond human recertification: This article is important because it shows that access review programmes built for employees now sit beside non-human access that can be harder to interpret and harder to own. That shifts governance from simple recertification cadence to identity context, ownership mapping, and access scoping across actor types. The practitioner conclusion is that access certification must be designed for mixed identity estates, not human accounts alone.

Identity context is the named concept that determines review quality: A reviewer cannot make a meaningful decision from a username and role name alone. The article points to identity context, application context, and entitlement context as the difference between informed governance and checkbox reviews. The practitioner conclusion is that review quality depends on richer context, not more reviewer effort.

Risk-based cadence is the right control logic for large estates: Not every application deserves the same review frequency. The article’s risk ranking approach reflects a control truth that large IAM programmes need differentiated cadence based on data sensitivity, business criticality, and regulatory exposure. The practitioner conclusion is that equal treatment of all applications is operationally neat but governance-poor.

From our research library:

• Over 70% of organisations lack automated access risk analysis, user access reviews and provisioning and deprovisioning, according to Pathlock's 2025 Digital Transformation and Access Risk Report.
• Read next: Access Reviews and Certification Guide

What this signals

Access review automation changes the control from event-based to lifecycle-based: When reviewers are still chasing spreadsheets, the programme is measuring activity rather than governing entitlement drift. Automation matters because it closes the loop between assignment, decision, and removal, which is where least privilege either holds or erodes.

Mixed identity estates require richer ownership models, not just more reviewers: The addition of machine identities and AI agents means the certification question is no longer only who approved access, but who can credibly own it and validate its removal. That is a governance design issue, not a workload issue.

Reviewer context is the difference between certification and compliance theatre: If the person making the decision cannot see enough identity and application context, the control degrades into a checkbox. Access review programmes should therefore be judged by decision quality and remediation closure, not by how many emails were sent.

For practitioners

• Inventory in-scope business applications Document ERP, SaaS, finance, HR, procurement, and any other systems that hold sensitive data or support critical processes. Assign business owners, technical owners, and compliance relevance before the next certification cycle begins.
• Set risk-based review cadence Rank applications by sensitivity, business criticality, regulatory pressure, fraud exposure, and operational impact, then review the highest-risk systems more frequently than low-risk systems.
• Automate reviewer assignment and reminders Use attribute-based ownership mapping such as department, manager, location, job title, or role ownership so review tasks route to the right owner and overdue items are visible in one dashboard.
• Validate removals in the source system Treat a denied entitlement as unresolved until the access is changed in the source application and the removal evidence is documented for audit and management reporting.
• Provide reviewers with decision context Include job title, department, location, manager, assigned roles, entitlements, and related application access so reviewers can decide whether the access still fits the role.

Key takeaways

• Manual access reviews no longer scale cleanly across hybrid estates because the review, routing, and remediation workload has outgrown the spreadsheet model.
• The article’s evidence shows that large programmes can involve hundreds of reviewers, tens of thousands of users, and hundreds of thousands of access lines in a single cycle.
• Automation matters because it makes access certification a real least-privilege control, not just an audit activity.

Key terms

• User Access Review: A user access review is a periodic check that confirms each account still needs the access it has. In identity programs, the control is used to reduce excess privilege, support compliance, and catch access that has outlived its business need.
• Access Certification: Access certification is the periodic review of whether an identity still needs its current entitlements. For NHIs, certification is only reliable when reviewers know the identity's owner, purpose, and expiry, otherwise stale machine access can persist long after the original use case has ended.
• Least Privilege: A security principle requiring that every identity, human or non-human, is granted only the minimum permissions necessary to perform its function. Least privilege is the single most effective control for reducing NHI blast radius.
• Identity context: The entitlement, ownership, and purpose information that explains why an action occurred and whether it was expected. For security operations, identity context turns raw alerts into decisions by showing which human or non-human identity acted and what it was allowed to do.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.