Lumos’ governance model shows where manual access reviews fail

At a glance

What this is: This is a vendor-authored governance case study showing how automating access reviews, SoD checks, and audit evidence can replace fragmented manual review work.

Why it matters: It matters because IAM, IGA, and PAM teams are being pushed toward continuous lifecycle governance, and manual review cadences increasingly fail to keep pace with entitlement drift.

Context

Access reviews are a governance control, not just an audit task. In this article, Lumos argues that periodic, manually coordinated reviews create delay, inconsistency, and weak evidence trails across user access management.

The governance problem is broader than review queues. Once access grants, role changes, and recertification all depend on separate tickets and emails, least privilege becomes difficult to enforce consistently across the application estate.

Key questions

Q: What breaks when access reviews stay manual?

A: Manual reviews break when reviewers cannot validate current business context quickly enough to identify toxic access, orphaned accounts, or stale approvals. The result is not just inefficiency, but false confidence, because the certification may be completed after the access has already become inappropriate. The control exists on paper, not in practice.

Q: Why do stale entitlements keep reappearing in access governance programmes?

A: Stale entitlements reappear when review cadence is slower than entitlement change and when reviewers lack context about actual usage. Roles evolve, temporary exceptions harden into routine access, and no one has a clean way to prove the access should be removed. The issue is governance drift, not just poor housekeeping.

Q: What are the signs that user access reviews are not working well?

A: Common warning signs include long review cycles, heavy reliance on spreadsheets, inconsistent evidence collection, and app owners who delay or ignore assigned reviews. Another red flag is recurring orphaned accounts, especially in systems without automated provisioning. If access decisions are not documented or no next review date is set, the process is probably too fragmented to control privilege effectively.

Q: How should organisations connect access reviews to compliance outcomes?

A: They should make each review produce an auditable chain from finding to remediation to sign-off. Compliance is stronger when the report shows what was checked, what changed, who approved the change and whether any exceptions remain open. That turns review from a checkbox exercise into evidence of control operation.

Technical breakdown

Why manual user access reviews break down at scale

Manual user access reviews depend on reviewers finding the right data, interpreting it consistently, and documenting decisions in a way auditors can later reconstruct. When access data lives in spreadsheets, tickets, and email threads, the control becomes fragmented and slow. The real failure is not just effort, but loss of governance continuity: stale entitlements can survive longer than the review cycle, and exceptions become hard to trace back to a decision point. In practice, this turns recertification into an event rather than an always-on control.

Practical implication: move review evidence, reviewer decisions, and remediation records into one governed workflow so access changes and audit trails stay linked.

How SoD flags and entitlement context change review quality

Segregation of duties works only when reviewers see enough context to understand whether two entitlements create a conflict. A review list by itself often misses the operational relationship between roles, groups, and functions. By layering usage context and policy logic onto the review, the governance control becomes more decision-relevant: reviewers can spot combinations such as procurement and approval authority in the same account. That is the difference between checking boxes and actually reducing fraud and compliance exposure.

Practical implication: enrich reviews with role, group, and usage context so SoD violations are evaluated as combinations, not isolated entitlements.

What continuous access governance means for RBAC and ABAC

Role-based and attribute-based models only stay clean when role mining and entitlement maintenance are ongoing, not occasional. If access patterns drift faster than role definitions are updated, RBAC becomes bloated and ABAC policies become stale or overfit. AI-assisted analysis can help surface recurring access clusters, unused permissions, and outliers, but the governance value comes from feeding those signals back into provisioning, review, and recertification. Continuous lifecycle control is what keeps the model aligned with how the business actually operates.

Practical implication: treat role mining and entitlement cleanup as an ongoing governance loop tied to provisioning and recertification, not a one-time design exercise.

Threat narrative

Attacker objective: The objective is to retain unnecessary access long enough to preserve privilege drift and weaken governance visibility.

1. Entry occurs through disjointed governance processes, where access review data is split across JIRA tickets, spreadsheets, and email chains.
2. Credential or entitlement misuse persists because reviewer context is incomplete, so stale access and out-of-scope roles survive beyond the intended review cycle.
3. Impact shows up as delayed remediation, weaker least privilege enforcement, and slower audit response when evidence must be reconstructed after the fact.

Breaches seen in the wild

• Azure Key Vault Contributor escalation 2024: Datadog found Azure Key Vault Contributor could add itself to access policies and read every secret, key and certificate in a vault.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Manual access reviews are now a control failure, not just an operations burden. When reviews depend on tickets, spreadsheets, and email follow-up, the programme loses timing, context, and evidence continuity. That means least privilege can be asserted on paper while stale access persists in production. For practitioners, the important question is whether review governance is still truly enforcing decisions or merely documenting them after the fact.

Access review automation changes the control point from reconciliation to decisioning. The article shows that the value is not speed alone, but the ability to keep reviewer context, SoD logic, and remediation in one system of record. That is a governance model shift, because the control is only effective when the evidence, the decision, and the entitlement change stay connected. Practitioners should treat that connection as part of the control itself.

AI-assisted identity agents are becoming governance amplifiers, not just workflow helpers. When an identity agent can surface unused licences, shadow access, and role patterns, it begins to influence governance decisions rather than only route tasks. That expands the governance perimeter into decision support, which is useful only if the organisation can explain and audit the logic behind those recommendations. The practical conclusion is that AI involvement in access governance needs explicit oversight, not informal trust.

Role mining and birthright policy management are now lifecycle controls, not design-time projects. The article shows that access models degrade when entitlement patterns are reviewed too late or too manually. A named concept here is governance drift debt: the accumulation of stale roles, unused access, and delayed recertification that makes policy look cleaner than the environment. Practitioners need to see that debt as an operational risk, not an administrative nuisance.

SOX, SOC 2, and internal policy evidence all depend on the same underlying control truth. If reviewer comments, timestamps, and access changes cannot be reconstructed quickly, compliance posture weakens even if the review was eventually completed. This is why access governance should be designed for evidence production as well as entitlement cleanup. The field should treat audit readiness as an output of good access governance, not a separate compliance chore.

What this signals

Governance drift debt: repeated manual review cycles create a backlog of stale access, unused entitlements, and delayed decisions that looks small until audit or incident response forces it to surface. The control failure is cumulative, which is why continuous governance matters more than periodic cleanup.

AI-assisted identity analysis changes the shape of access governance by moving review teams from document chasing to exception handling. That is useful only when the organisation keeps the decision logic, entitlement data, and remediation path tightly coupled.

The main lesson for practitioners is that access reviews are no longer a discrete compliance event. They are part of the lifecycle control plane that determines whether least privilege is provable at all.

For practitioners

• Standardise access review workflows Move review initiation, reviewer assignment, decision capture, and remediation tracking into one governed workflow so the control has a single audit trail.
• Embed SoD policy logic in recertification Configure segregation of duties rules so reviewers see entitlement combinations and conflicts directly in the review screen, not in a separate policy document.
• Use usage context to reduce false approvals Include application usage data, role context, and entitlement history so reviewers can distinguish active need from stale or out-of-scope access.
• Treat role mining as a continuous lifecycle activity Review recurring access patterns, unused permissions, and outliers on an ongoing basis so RBAC and ABAC definitions stay aligned with current business use.
• Preserve evidence for audit and remediation Keep timestamps, comments, decisions, and downstream access changes together so compliance teams can reconstruct what happened without manual evidence chasing.

Key takeaways

• Manual access reviews create governance drift when evidence, decisions, and remediation are handled in separate workflows.
• The strongest signal in the article is that SoD checks, role context, and review history must stay in one control path to remain auditable.
• Practitioners should treat access reviews as a continuous lifecycle control, not a periodic cleanup task.

Key terms

• User Access Review: A user access review is a periodic check that confirms each account still needs the access it has. In identity programs, the control is used to reduce excess privilege, support compliance, and catch access that has outlived its business need.
• Segregation of Duties: Segregation of Duties is a control principle that prevents one person or role from combining incompatible permissions that could create fraud, error, or undetected change. In ERP environments, it must account for roles, transactions, approvals, and compensating controls across business processes.
• Role Mining: Role mining is the process of analysing entitlement patterns to infer reusable access roles from existing assignments. In mature IAM programmes, it can reduce manual modelling effort, but it only works well when the source data is clean, policy-aligned, and not already distorted by exceptions or oversharing.
• Audit Trail: An audit trail is a record of who accessed a system, what they did, and when they did it. For PHI environments, it provides the evidence needed to investigate incidents, support breach determinations, and demonstrate that access was attributable to a specific identity or workflow.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.