TL;DR: C1.ai says Treasure Data’s user access review programme moved from sporadic spreadsheet checks and 160 annual hours to intelligent, risk-scoped reviews with automated conflict detection, broader entitlement coverage, and faster remediation. The real shift is that review maturity now depends on continuous depth and exception handling, not campaign volume alone.
At a glance
What this is: This is a case study on how Treasure Data moved user access reviews from manual spreadsheet campaigns to intelligently scoped, automated governance with broader coverage and faster remediation.
Why it matters: It matters because IAM and IGA teams often measure review progress by campaign completion, when the real control value comes from review depth, exception handling, and coverage of high-risk entitlements.
👉 Read C1.ai's analysis of Treasure Data’s user access review maturity journey
Context
User access reviews are a governance control, not a paperwork exercise. The weak point in early programmes is usually not intent but scope: teams review what is easy to export, not what is most risky to keep.
This case shows a familiar IGA pattern. Manual quarterly campaigns can train people and create repeatability, but they do not scale well when the estate includes privileged access, external accounts, inactive users, and unused permissions.
Treasure Data’s starting position was typical for a phase 1 programme: high effort, narrow coverage, and limited security value.
Key questions
Q: What breaks when user access reviews stay spreadsheet-based?
A: Spreadsheet-based reviews break because they capture a stale snapshot, hide effective permissions, and rely on human follow-up for enforcement. By the time approvals return, access may already have changed. The result is rubber-stamped decisions, slow revocation, and weak audit evidence. Continuous identity ingestion and automated remediation close those gaps.
Q: When should teams prioritise scoped reviews over full access campaigns?
A: Teams should prioritise scoped reviews when the access estate includes privileged accounts, external users, inactive users, or unused permissions that a full campaign would handle too broadly. Narrowing the review to risky entitlements improves signal quality and makes remediation more achievable without waiting for the next quarterly cycle.
Q: Why do access reviews often fail to reduce real risk?
A: Access reviews often fail when they produce evidence without changing the underlying entitlement state. If the review process does not trigger revocation, privilege reduction, or exception handling, it documents risk rather than reducing it. That is why lifecycle enforcement matters more than a completed certification.
Q: How should IAM teams connect access reviews to RBAC and JIT access?
A: IAM teams should use review findings to simplify roles, remove recurring exceptions, and identify where standing privilege can be replaced with just-in-time access. Reviews should not sit apart from entitlement design. They should inform how access is provisioned, narrowed, and removed over time.
Technical breakdown
Why spreadsheet-based access reviews stall at phase 1
Manual user access review programmes tend to start with exports, spreadsheets, and human judgment. That model breaks down because the reviewer is forced to make decisions from incomplete context, one system at a time, while entitlements keep changing between campaigns. The result is surface-level certification rather than real governance. The core limitation is not effort alone, but the inability to connect identity, role, and entitlement context at scale across systems.
Practical implication: move beyond one-off spreadsheets and define the data sources, ownership, and exception paths before scaling reviews.
How intelligently scoped reviews change the control model
Intelligently scoped user access reviews shift the unit of work from a full population campaign to the riskiest access paths and exceptions. Instead of asking whether every user looks right at a fixed interval, teams focus on conflicts, privileged access, external accounts, inactive users, and unused permissions. That changes the control from a periodic audit exercise into a governance mechanism that follows risk, relevance, and access change patterns.
Practical implication: design review scope around entitlement risk, not around organisational convenience or calendar cadence.
Why remediation speed matters as much as review coverage
A review control only changes outcomes if flagged issues are resolved quickly. In mature programmes, exceptions need a short path from detection to ticketing and closure, otherwise the organisation just accumulates findings. Automated routing to workflow tools compresses the time between review and action, which is what turns review data into risk reduction rather than documentation. That is the difference between a compliance artifact and an operational control.
Practical implication: connect review findings to workflow and closure SLAs so exceptions do not sit unresolved after certification.
NHI Mgmt Group analysis
Access review maturity is defined by depth, not campaign frequency: Quarterly certification alone does not tell you whether the programme is actually governing access risk. Once an organisation can review broader entitlement classes, surface conflicts in real time, and push exceptions into workflow, the control starts to behave like governance rather than bookkeeping. The practitioner conclusion is that frequency without scope is a weak maturity signal.
Manual exports create a structural blind spot in IGA: Spreadsheet-driven reviews naturally favour the easiest data to extract, which means privileged access and non-obvious entitlements are the first to be under-reviewed. That is not a tooling inconvenience, it is a governance bias that rewards completeness theatre over risk relevance. The practitioner conclusion is to treat export-heavy review design as a maturity ceiling, not a starting point.
Continuous assurance is the real phase change: The move from periodic campaigns to exception-driven alerts changes the control from retrospective certification to near-real-time governance. That matters because access risk often appears between review cycles, not inside them. The practitioner conclusion is to measure whether the programme can catch and route exceptions while they are still actionable.
RBAC and JIT become the next logical step after review scope widens: When teams can see which entitlements repeat as exceptions, they can start using that evidence to shape role design and reduce standing privilege. Access reviews should therefore feed entitlement simplification, not sit beside it as a separate compliance lane. The practitioner conclusion is to connect review findings to role engineering and just-in-time access design.
Phase 3 review maturity exposes the limits of compliance theatre: The strongest signal in this case is not automation for its own sake, but the shift from checking boxes to producing meaningful security outcomes. That is the benchmark IGA teams should use when evaluating their own programme. The practitioner conclusion is to ask whether the review process is changing access behaviour or merely documenting it.
From our research library:
- Over 70% of organisations lack automated access risk analysis, user access reviews and provisioning and deprovisioning, according to Pathlock's 2025 Digital Transformation and Access Risk Report.
What this signals
Review programmes should be judged by what they remove, not how many campaigns they run: If a quarterly process produces the same exceptions every time, it is not maturing governance. The better signal is whether access scope narrows, exceptions resolve faster, and high-risk entitlements stop recurring in the same pattern.
Access review depth is now an entitlement-design problem: Once teams can see privileged access and unused permissions clearly, the next step is not more review volume. It is using those findings to simplify roles, reduce standing access, and move repetitive exceptions out of the recurring review path.
For practitioners
- Define review scope by entitlement risk Prioritise privileged access, external accounts, inactive users, unused permissions, and sensitive groups before expanding to low-risk access populations.
- Replace spreadsheet certification with workflow-linked exceptions Route flagged access issues directly into ticketing or case management so reviewers can track ownership and closure instead of exporting findings manually.
- Use conflict detection for continuous monitoring Trigger alerts when high-risk entitlements or policy conflicts appear between campaigns, so review controls catch change as it happens.
- Feed review findings into role design Use recurring exceptions to identify candidates for RBAC cleanup, entitlement removal, and tighter just-in-time access boundaries.
- Measure whether reviews reduce access risk Track whether each cycle narrows unresolved exceptions, improves coverage of risky entitlements, and shortens remediation time.
Key takeaways
- Manual user access reviews often create compliance evidence without materially improving access governance, especially when scope is limited to whatever can be exported quickly.
- Treasure Data’s shift to intelligently scoped reviews shows that broader entitlement coverage and faster remediation are what make the control useful.
- The practical lesson for IAM and IGA teams is to connect review findings to role cleanup, exception handling, and reduced standing privilege.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST CSF 2.0, CIS Controls v8 and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | The article is about governing user entitlements and access review depth. |
| Recommendation — Apply PR.AA-05 to review and constrain entitlements based on risk, not campaign convenience. | ||
| CIS Controls v8 | CIS-5 — Account Management | The post centres on account review, exception handling, and lifecycle governance. |
| Recommendation — Use CIS-5 to standardise account review, ownership, and remediation across the access estate. | ||
| NIST SP 800-53 Rev 5 | AC-6 — Least Privilege | The article’s roadmap toward reduced standing access and better entitlement scope maps directly to least privilege. |
| Recommendation — Apply AC-6 to remove unnecessary access and align review findings with least-privilege role design. | ||
Key terms
- User Access Review: A user access review is a periodic check that confirms each account still needs the access it has. In identity programs, the control is used to reduce excess privilege, support compliance, and catch access that has outlived its business need.
- Intelligently Scoped Review: An intelligently scoped review focuses certification effort on the access that matters most, rather than treating every entitlement as equally urgent. For IAM and IGA teams, this means using risk, ownership, and usage context to decide what gets reviewed continuously and what can be handled less often.
- Standing Privilege: Standing privilege is access that remains active even when no immediate task requires it. For NHI programmes, it is a common failure mode because long-lived credentials and persistent roles create unnecessary exposure. Reducing standing privilege usually means tighter expiry, on-demand access, and clearer review of who or what still needs access.
- Exception-driven Review: An exception-driven review is a model where the system highlights only unusual or risky access for human judgement. This reduces noise, shortens review cycles, and makes remediation the centre of the control, rather than the production of a completed campaign report.
What's in the full article
C1.ai's full blog covers the operational detail this post intentionally leaves for the source:
- The step-by-step transition from ad-hoc spreadsheet checks to quarterly structured access review campaigns.
- Specific examples of the entitlement types Treasure Data expanded into, including privileged access and inactive users.
- The workflow mechanics for turning exceptions into Jira tickets and shortening remediation time.
- The roadmap toward phase 4, including RBAC matrix design and real-time exception-based alerts.
Deepen your knowledge
NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.
Published by the NHIMG editorial team on June 8, 2026.
Updated on October 7, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org