Self-service access reviews expose the next IAM governance gap

At a glance

What this is: This is an analysis of how self-service access requests and user access reviews change the governance model for IAM, with Lumos arguing that decentralised approvals can reduce friction without removing accountability.

Why it matters: IAM teams should care because self-service only works if approver ownership, auditability, and least privilege remain intact when request paths move away from a central IT queue.

By the numbers:

• The Lumos AppStore has helped redirect ~50 IT tickets per week, reducing ticket volume and manual approval churn.

Context

Self-service access reviews move approval and recertification work away from a central IT queue and closer to the application owner or business approver. That can improve speed, but it also changes the governance model because the control is no longer enforced by a single operations team.

For IAM and IGA programmes, the key question is whether decentralised workflows still produce clear evidence of who approved what, when, and on what basis. If the approval chain becomes easier to use but harder to govern, the organisation has traded away control rather than removed friction.

Lumos uses its own platform internally as the example, but the broader issue is programme design: access governance must remain auditable when requestors, approvers, and IT all interact through self-service channels.

Key questions

Q: How should IAM teams improve access request governance without adding friction?

A: Start by simplifying the request model, not by adding more approval layers. Each request template should map to a specific entitlement set, an explicit approver path, and a clear business purpose. That reduces ambiguity, shortens manual handling, and makes the resulting approval decisions easier to audit and defend.

Q: Why can user access reviews fail even when the process is completed on time?

A: They fail when the reviewer lacks ownership context or cannot judge whether the entitlement still fits the business need. Completion alone does not prove that access was meaningfully certified. Teams should evaluate the quality of the decision, the reviewer’s authority, and the evidence trail behind the approval.

Q: What are the biggest governance mistakes in self-service access workflows?

A: The most common mistakes are vague entitlement descriptions, incorrect approver routing, and treating ticket reduction as a security metric. These flaws make the process look efficient while weakening least privilege and auditability. Strong workflows depend on precise ownership and transparent approval records.

Q: When does decentralised access approval create more risk than it removes?

A: It creates more risk when approvers are overloaded, untrained, or disconnected from the entitlement they are approving. In that case, self-service becomes a faster way to approve bad decisions. Decentralisation only helps when ownership is clear and the approval evidence is defensible.

Technical breakdown

How self-service access requests change the approval model

Self-service access request flows replace a central ticketing queue with a distributed approval path. The practical change is not just faster routing. It is that entitlement decisions move to the app owner or business approver, often with requestor visibility and direct communication. That can reduce back-and-forth, but it also means governance depends on clean approval assignment, clear entitlement descriptions, and reliable audit trails. If the wrong approver is selected, the workflow still looks efficient while the control objective fails. Practical implication: treat approver mapping and entitlement ownership as governance objects, not just workflow settings.

Practical implication: validate that each entitlement maps to the correct approver and that the approval record is retained in a form auditors can follow.

Why user access reviews break when ownership is distributed

User access reviews, or UARs, only work when the reviewer understands what the access is for, who owns it, and whether it still matches business need. In a decentralised model, that responsibility shifts outward, which can improve context but also creates failure modes if app owners are unclear, inactive, or overloaded. The review becomes a formality if reviewers click through without understanding entitlement scope. The governance risk is not self-service itself, but weak review quality once IT is no longer the default decision-maker. Practical implication: measure whether reviews are completed with meaningful owner input, not just whether they are completed on time.

Practical implication: sample completed reviews for evidence of informed approval, not just closure status.

Least privilege depends on entitlement granularity, not ticket volume

Least privilege is preserved when users can request only the access they actually need and approvers can see the scope of each entitlement clearly. Ticket reduction by itself does not prove better security. It only shows that the workflow is more efficient. The security gain comes when the self-service catalogue makes access requests more specific, approval decisions more informed, and standing access less likely to accumulate. Without that, a slicker workflow can still distribute excessive access faster. Practical implication: assess whether self-service is shrinking entitlement scope or merely accelerating approvals.

Practical implication: review the catalogue for overly broad entitlements that self-service may be normalising.

NHI Mgmt Group analysis

Self-service access reviews do not eliminate governance friction, they relocate it. The central question is whether decision authority can be pushed outward without weakening evidence quality. When requestors, app owners, and IT all participate, the control plane becomes more distributed, so the governance burden shifts from queue management to ownership discipline and auditability.

Access review quality is the real control, not review completion volume. A completed certification cycle means little if reviewers are not the right owners or cannot judge whether the entitlement still matches the job. Self-service can make reviews easier to perform, but it can also make shallow approvals easier to hide. That is an IGA problem, not a workflow problem.

Distributed approval paths create an accountability gap if entitlement ownership is not explicit. The article shows that direct routing to approvers can reduce IT tickets, but it also makes the approver relationship part of the control itself. That means teams must govern who can approve, what they are approving, and how that approval is evidenced. The practitioner conclusion is that accountability has to be engineered into the workflow, not assumed from it.

Least privilege survives decentralisation only when the entitlement model is precise. Self-service works as a governance control when access requests are narrow, understandable, and tied to a specific owner. If the catalogue contains broad bundles or ambiguous descriptions, the speed gains simply move over-permissioning into a smoother process. The implication is that governance quality must be measured at the entitlement layer, not the ticket layer.

Self-service access governance is becoming an operating model issue, not just an IAM feature. Once access requests and UARs are embedded in Slack, the web, and direct approver messaging, identity teams are no longer managing a single process but an access operating system. That calls for clear ownership, traceable approvals, and recurring review of whether decentralisation is still producing defensible controls.

From our research library:

• 97% of NHIs carry excessive privileges, increasing unauthorised access and broadening the attack surface, according to the Ultimate Guide to NHIs.
• Read next: Access Reviews and Certification Guide

What this signals

Self-service access governance: the control problem shifts from moving tickets faster to proving that distributed approvals are still defensible. Once requestors and approvers interact directly, IAM teams need to verify that every approval path still leaves behind evidence an auditor can reconstruct.

Access reviews are only meaningful when the person certifying access has enough context to judge necessity and scope. That makes entitlement design, approver assignment, and review evidence the real programme controls, not the number of requests deflected from IT.

For practitioners

• Standardise approver assignment Define which app owner or business role is authorised to approve each entitlement, and keep that mapping current as applications and teams change.
• Audit user access review quality Sample completed reviews for evidence that the reviewer understood the entitlement and business need, not just that the review was closed.
• Tighten entitlement descriptions Rewrite catalogue entries so requestors and approvers can see the exact access being requested, which limits vague or bundled approvals.
• Track governance outcomes, not only ticket volume Measure whether self-service is improving decision quality, reducing escalations, and preserving audit trails instead of only counting deflected requests.

Key takeaways

• Self-service access reviews can reduce operational friction, but they also expose whether governance ownership is explicit enough to survive decentralised approvals.
• The article’s evidence points to lower ticket volume and faster routing, which are useful only if they still produce clear audit trails and least-privilege decisions.
• IAM teams should treat approver mapping, entitlement precision, and review quality as the controls that decide whether self-service strengthens or weakens governance.

Key terms

• Self-Service Access: Self-service access lets users request, approve, or obtain access to systems and data through a controlled workflow without manual intervention from an administrator. It usually relies on policy checks, identity verification, and automated provisioning, so access is granted only when the request matches defined roles, attributes, risk conditions, and approval rules.
• User Access Review: A user access review is a periodic check that confirms each account still needs the access it has. In identity programs, the control is used to reduce excess privilege, support compliance, and catch access that has outlived its business need.
• Entitlement Ownership: The assignment of accountability for a specific access right, application permission, or entitlement set to a named business owner. It is the control that gives approvals meaning. Without ownership, automation can still issue access, but no one can credibly explain why the access was approved or when it should be revoked.
• Least Privilege: A security principle requiring that every identity, human or non-human, is granted only the minimum permissions necessary to perform its function. Least privilege is the single most effective control for reducing NHI blast radius.

Deepen your knowledge

NHI governance, identity lifecycle management, and secrets management are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM or identity governance programme, it is worth exploring.