TL;DR: Quarterly access reviews validate access at a point in time, but role changes create hidden exposure between cycles as old entitlements persist, new privileges are added, and access drift builds, according to OpenIAM. Calendar-based governance can prove oversight without reflecting the real-time access posture of internal mobility.
At a glance
What this is: This article explains how role changes between quarterly access reviews create hidden IAM risk by allowing legacy permissions to persist while new privileges are added.
Why it matters: It matters because IAM and IGA teams can show review completion without seeing the real-time access changes caused by promotions, transfers, and project moves.
Context
Quarterly access reviews are a point-in-time governance control, not a live view of entitlement change. In IAM and IGA programmes, that matters because internal mobility can change what a person should access the moment a role changes, while certification evidence does not move at the same pace.
This creates a structural gap between event-based risk and calendar-based oversight. The article frames that gap as role-change access risk, where old access may remain active, new access may be added, and the combined effect is broader privilege than the current role requires.
That pattern is common in organisations with promotions, transfers, and temporary project work, so the starting position is typical rather than exceptional.
Key questions
Q: What breaks when access reviews do not keep pace with role changes?
A: When reviews lag behind role changes, stale permissions survive longer than the job that justified them. That creates hidden lateral movement paths, especially when compromised credentials still carry former departmental or privileged access. The result is a control gap between approved access and actual operational need.
Q: Why do role changes create so much access creep?
A: Role changes create access creep because organisations are faster at adding new access than removing old access. The old permissions are often still usable, carry no immediate operational pain, and therefore survive the transition. The result is accumulated access from previous roles that expands blast radius and weakens least privilege.
Q: How can IAM teams detect access drift after internal mobility?
A: Look for users whose current role does not explain all active entitlements, especially after promotions, transfers, or project assignments. Historical permissions, temporary access, and cross-functional privileges are the main clues. If the access set is wider than the job needs, drift has already started.
Q: When should organisations move from fixed access review cycles to event-based reviews?
A: They should do it when role churn, contractor turnover, or privilege changes happen more often than a quarterly or annual cycle can reflect. Event-based reviews are better for access that changes with business activity, while fixed cycles are acceptable only for low-risk, stable entitlements.
Technical breakdown
Why role changes create access layering
When a person moves into a new role, the organisation often grants the new entitlements before the old ones are removed. That produces access layering, where historical permissions and current-role permissions coexist. The result is not just extra access, but a wider permission set that no single role assignment intentionally approved. In identity governance terms, the failure is temporal alignment: the access model expects removal and issuance to complete together, but operational reality often separates them across HR updates, approver workflows, and application administration.
Practical implication: treat role change as a removal-and-issuance event, not only as a new-access request.
Why delayed deprovisioning extends exposure windows
Delayed deprovisioning happens when legacy entitlements remain active after the business reason for them has ended. The article points to multiple handoffs, including HR updates, identity platform changes, and application-owner approvals, each of which can lag. That lag matters because the user’s current role already changed, but the old authority still exists. In practice, the exposure window is created by process sequencing, not by a single broken control. The longer those steps stay out of sync, the longer unnecessary access persists.
Practical implication: map role-change handoffs and remove ownership ambiguity before the next certification cycle.
How access drift accumulates between certification cycles
Access drift is the cumulative effect of repeated role changes, project assignments, and temporary privileges that are never fully cleaned up. Quarterly reviews see the current snapshot, but they often miss the historical layering underneath it. That means reviewers may approve what looks reasonable today while overlooking permissions inherited from prior roles. Over time, the user’s access footprint expands beyond the minimum needed for the current job, and the gap becomes harder to detect the longer it goes uncorrected.
Practical implication: inspect historical entitlement lineage, not just current-role membership, during governance reviews.
Threat narrative
Attacker objective: The objective is not external compromise but accumulation of excessive internal access that outlives the role change.
- Entry occurs when an employee changes roles through promotion, transfer, or project assignment, and the identity model updates more slowly than the business event.
- Privilege escalation follows as new role-based permissions are added while old entitlements remain active, creating access layering.
- Impact is broader-than-intended system access that persists until the next review cycle, increasing the chance of misuse or overexposure.
Breaches seen in the wild
- Azure Key Vault Contributor escalation 2024: Datadog found Azure Key Vault Contributor could add itself to access policies and read every secret, key and certificate in a vault.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Role-change access risk is an entitlement lifecycle problem, not a review-frequency problem. The article shows that quarterly certification can be completed exactly as designed while exposure still increases the same day a person changes roles. That means the control is validating governance activity, not the actual state of authority. Practitioners should read this as a lifecycle timing failure: access change events happen continuously, but review evidence arrives on a schedule.
Calendar-based oversight creates a false sense of closure. Certification tasks document that someone looked, but they do not guarantee that the access posture stayed stable between cycles. In identity governance, that is a material distinction because audit evidence and operational risk are not the same thing. The discipline has to move from proving review completion to proving role-change reconciliation.
Access layering is the right named concept for this gap. It captures the way old and new entitlements coexist after internal mobility, producing a broader permission set than the role itself requires. That layering is especially dangerous because it accumulates quietly across promotions, transfers, and projects. The practitioner lesson is to manage entitlement lineage as a first-class governance object.
Role-change exposure shows why IGA programmes must be event-aware. When the business changes a person’s responsibilities, the identity programme has to react to that event, not wait for the next campaign. This is where access governance, HR triggers, and application ownership need tighter synchronisation. Otherwise, the programme can demonstrate control without actually reducing risk.
The governance question is not whether reviews still matter, but whether they are late. Quarterly access reviews remain useful for evidence, accountability, and exception handling. But they are insufficient if the most important risk spike occurs immediately after mobility events. Mature programmes will measure how quickly role changes are reconciled, not just how often access is certified.
From our research library:
- Over 70% of organisations lack automated access risk analysis, user access reviews and provisioning and deprovisioning, according to Pathlock's 2025 Digital Transformation and Access Risk Report.
What this signals
Access-change timing is the control gap. IAM teams should focus on how quickly role changes are reconciled across HR, identity, and application ownership workflows. If the business event arrives first and governance catches up later, the programme is measuring review completion rather than reducing exposure.
Access layering should become a monitored condition. A role change should trigger a search for overlapping entitlements, temporary elevation, and permissions inherited from prior assignments. That gives IGA teams a practical way to identify drift before it becomes normalised.
Event-aware governance matters more than shorter review cycles. More frequent certification can reduce the size of the blind spot, but it does not remove the blind spot itself. The better test is whether the programme can reconcile access when the role changes, not whether it can review faster.
For practitioners
- Tie role changes to entitlement removal Trigger deprovisioning and re-approval workflows when a user changes role, not only when a review campaign opens. The goal is to close the old access path as part of the mobility event, before legacy entitlements can stack with new ones.
Key takeaways
- Role changes between reviews create hidden IAM exposure because old access can stay active while new access is granted.
- Quarterly certification can prove oversight without reflecting the live access posture created by internal mobility.
- The most effective control is event-driven reconciliation that closes legacy access as part of the role-change process.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST CSF 2.0, CIS Controls v8 and NIST SP 800-53 Rev 5 set the technical controls, while ISO/IEC 27001:2022 defines the regulatory obligations.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | The article centres on entitlement drift and role-change governance. |
| Recommendation — Align entitlement changes with role events and reconcile authorisations before certification closes. | ||
| CIS Controls v8 | CIS-5 — Account Management | Role changes require account and entitlement updates across multiple systems. |
| Recommendation — Use account management controls to remove legacy access as part of each role transition. | ||
| NIST SP 800-53 Rev 5 | AC-6 — Least Privilege | The article describes access that exceeds the current role after mobility events. |
| Recommendation — Apply least privilege reviews to strip permissions that no longer match the user’s active role. | ||
| ISO/IEC 27001:2022 | A.5.18 — Access Rights | Access rights must be updated when business responsibilities change. |
| Recommendation — Review and update access rights whenever a user changes roles or responsibilities. | ||
Key terms
- Policy Layering: Policy layering is the practice of applying different rules at different decision points, such as application, entitlement, and review. It improves scale and precision when it is deliberate. It becomes risky when layers overlap without a clear authority model or exception path.
- Deprovisioning: Deprovisioning is the removal of access when a user changes roles or leaves an organisation. For security teams, it is the point where stale accounts, tokens, and permissions should disappear. Weak deprovisioning leaves residual access that can outlive the business need that created it.
- Answer Drift: Answer drift is the gradual change in a model’s responses over time, often showing up as reduced consistency or increasing error rates. It can signal degraded grounding, shifting data quality, or prompt and retrieval issues. Monitoring drift helps teams catch reliability problems before they become widespread user-facing failures.
- Role-Change Access Risk: Role-change access risk is the exposure created when internal mobility changes a user’s authority before governance catches up. It is an identity governance timing problem, where the real risk event is the move itself, not the next scheduled certification.
Deepen your knowledge
NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.
Published by the NHIMG editorial team on July 8, 2026.
Updated on October 11, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org