TL;DR: As cloud services, mobile access and remote work expand the attack surface, user access reviews become the control that keeps permissions aligned with business need, according to Zluri. Regular certification helps limit privilege creep, dormant accounts and compliance drift, but only if reviews are operationally enforced, not treated as a calendar exercise.
At a glance
What this is: This is a Zluri analysis of why user access reviews have become the practical boundary of the identity perimeter as cloud, mobile and remote work expand access paths.
Why it matters: It matters because IAM and IGA teams now have to treat certification, role alignment and deprovisioning as core security controls across human access and adjacent identity governance processes.
Context
The article argues that the traditional network perimeter no longer protects the way most organisations actually operate. Cloud services, mobile devices and remote work have made identity the main control point, which shifts attention from where a user connects to whether that user should still have the access they have.
In that model, user access reviews are not a compliance afterthought. They are the governance checkpoint that keeps permissions aligned with job role, business need and change over time, especially where accounts move across SaaS, remote endpoints and multiple approval paths.
Key questions
Q: What breaks when access reviews are treated as a compliance exercise only?
A: You get sign-off without assurance. Reviews that check boxes but do not verify entitlement accuracy, ownership, and business purpose will miss stale permissions, orphaned accounts, and third-party access that no longer has a valid justification. The result is auditable paperwork with weak real-world control.
Q: Why does remote work make access reviews less reliable?
A: Remote work increases the number of applications, devices, and collaboration paths that can carry access. That makes reviews less reliable when the review scope depends only on the directory and not on shadow SaaS or downstream entitlements. Teams need evidence of actual application use, not just named assignments.
Q: How can security teams tell whether privileged access reviews are actually working?
A: They are working when every privileged entitlement is inventoried, every decision is traceable, and revoked access is removed from all connected systems without delay. If the organisation can only show approvals but not downstream revocation, the review is administrative recordkeeping rather than governance. Proof of removal is the best maturity signal.
Q: What should teams prioritise first: provisioning automation or access reviews?
A: If access assignment is still manual and inconsistent, provisioning automation usually comes first because it creates the control trail that reviews need. But reviews remain necessary to catch policy errors, inherited permissions, and exceptions that automation cannot safely infer. The two controls should reinforce each other, not compete.
Technical breakdown
Why the identity perimeter depends on access certification
An identity perimeter is a control model that treats the user, not the network edge, as the primary trust boundary. That means authentication, authorization and periodic access validation all have to work together because access can be consumed from anywhere. User access reviews close the gap between what was granted and what is still justified, especially when cloud apps, mobile devices and contractors create more volatile access patterns than classic on-premises environments.
Practical implication: treat access certification as a standing identity control, not a periodic audit task.
Why least privilege decays without continuous review
Least privilege is not a one-time provisioning outcome. Roles change, projects end, contractors move, and permissions accumulate faster than most teams notice. Without regular review, dormant accounts and overassigned entitlements become normal rather than exceptional, which widens the attack surface and weakens accountability. In practice, the review process is the only mechanism that reveals whether privilege still matches business need rather than historical convenience.
Practical implication: build review cycles that actively remove stale access instead of merely recording it.
How IGA platforms operationalise user access reviews
Identity governance and administration platforms centralise entitlements, review workflows and evidence collection so that certifiers can see what a user actually has across applications and directories. The technical value is not just automation, but traceability: who reviewed what, what was approved, what was removed and when. That matters because access governance fails when the evidence trail is fragmented or when remediation is disconnected from the review decision.
Practical implication: use IGA workflows that link certification decisions directly to removal actions and audit evidence.
Threat narrative
Attacker objective: The objective is to exploit stale or excessive permissions that should have been removed by governance but were left in place.
- entry: Users reach business systems through cloud services, mobile devices and remote connections instead of a fixed internal perimeter.
- escalation: Permissions drift as users change roles, contractors retain access, or approvals are left unreconciled after business changes.
- impact: Excess access increases the chance of unauthorized data exposure, insider misuse or compliance failure.
Breaches seen in the wild
- Microsoft verified publisher OAuth phishing 2022: Malicious OAuth apps with a fraudulently obtained Microsoft verified publisher badge tricked UK users into granting mailbox access in 2022.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 150+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Identity governance becomes the control plane when the perimeter disappears: The article captures a real operating shift, not a branding exercise. When users access SaaS, mobile endpoints and remote resources from many locations, the old perimeter model stops being the primary trust boundary. The governance consequence is that certification, provisioning discipline and role alignment become the practical perimeter for human access, and teams that still treat review cycles as administrative work are managing the wrong layer.
User access reviews are strongest when they enforce removal, not just approval: Certification only matters if it changes the entitlement state. If review workflows produce attestations without timely deprovisioning, the organisation records intent but leaves exposure unchanged. That is why access governance must be judged by how quickly it closes privilege drift, not by how many review tickets are closed.
Identity sprawl turns dormant access into a standing risk, not an edge case: The article points to a common failure pattern in cloud and remote environments: permissions outlive the business reason for granting them. That is a lifecycle problem, not a tooling problem alone. The practitioner lesson is that every delayed recertification, unmanaged contractor account and stale SaaS entitlement expands the gap between policy and real access.
Access review programmes now sit at the intersection of IAM, IGA and compliance evidence: The same control is doing three jobs at once. It limits privilege creep, supports audit defensibility and exposes where role design no longer matches how the organisation actually works. The field should stop describing reviews as a box to tick and start treating them as a measurable identity boundary control.
From our research library:
- Over 70% of organisations lack automated access risk analysis, user access reviews and provisioning and deprovisioning, according to Pathlock's 2025 Digital Transformation and Access Risk Report.
- Read next: Access Reviews and Certification Guide
What this signals
Access review cadence now defines the practical identity boundary: When users move across SaaS apps, remote devices and changing roles, the question is no longer whether a firewall sees the session. The question is whether the organisation can still justify the entitlement at the point of review, which makes certification cadence a governance control rather than a reporting rhythm.
Review workflows need to collapse approval and remediation into one control loop: A certification that does not drive removal simply preserves stale access in a more documented form. Security teams should watch for delayed revocations, unresolved exceptions and review ownership gaps, because those are the operational signs that the identity perimeter is leaking.
For practitioners
- Tighten certification scope around business roles Group entitlements by job function, application owner and access sensitivity so reviewers can decide on actual business need rather than raw entitlement lists.
- Link review outcomes to immediate deprovisioning Ensure every revoke, downgrade or exception created in a certification workflow triggers a removal action in the source system and is verified in the audit trail.
- Prioritise dormant and high-risk accounts first Focus the earliest review cycles on inactive users, contractors, privileged users and accounts tied to sensitive SaaS applications where excess access is most dangerous.
- Define ownership for review completion Assign clear reviewers, fallback reviewers and application owners so access decisions cannot stall when teams change or responsibilities are ambiguous.
- Measure review quality, not just completion Track how many certifications actually remove access, how long remediation takes and how often revocations are reopened or overridden.
Key takeaways
- User access reviews have become a primary governance boundary because cloud and remote work weaken the old network perimeter.
- The article ties certification to least privilege, dormant account cleanup and compliance evidence rather than to paperwork alone.
- Teams should measure reviews by removal speed, entitlement drift reduction and the quality of the audit trail they produce.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 addresses the attack and risk surface, while NIST CSF 2.0, NIST SP 800-53 Rev 5 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | The article is about validating and maintaining user entitlements across changing access contexts. |
| Recommendation — Apply PR.AA-05 to keep permissions aligned with current business need and review outcomes. | ||
| NIST SP 800-53 Rev 5 | AC-6 — Least Privilege | The core theme is preventing privilege creep through regular access review. |
| Recommendation — Use AC-6 to remove excess access that no longer matches role or business necessity. | ||
| OWASP Non-Human Identity Top 10 | NHI-01 — Improper Offboarding | The article highlights stale and dormant access that remains after role or employment changes. |
| NHI-05 — Overprivileged NHI | Excess permissions are the main risk pattern discussed in the access review context. | |
| Recommendation — Map delayed revocation and stale entitlements to NHI-01 and verify offboarding closes access paths. Review entitlements for overprivilege and remove access that exceeds current task requirements. | ||
| CIS Controls v8 | CIS-5 — Account Management | The article centres on maintaining current account access and deprovisioning stale accounts. |
| Recommendation — Apply CIS-5 to keep account inventories current and revoke unnecessary access promptly. | ||
Key terms
- Identity Perimeter: The identity perimeter is the access boundary defined by who or what is requesting entry, not by where the request comes from. In zero trust, it is the point where authentication, authorization, and risk context decide whether a caller can proceed.
- Access Certification: Access certification is the periodic review of whether an identity still needs its current entitlements. For NHIs, certification is only reliable when reviewers know the identity's owner, purpose, and expiry, otherwise stale machine access can persist long after the original use case has ended.
- Privilege Creep: Privilege creep is the gradual accumulation of access rights beyond what an identity actually needs. It usually happens when permissions are added for convenience and never removed. For NHIs, privilege creep expands blast radius and makes old credentials far more dangerous than their original purpose suggests.
- Dormant account: A dormant account is an identity that has not been used within a defined period but still retains active access. The risk is not only wasted licensing. Dormant access often becomes stale standing privilege, which makes offboarding, certification, and incident response harder to execute cleanly.
Deepen your knowledge
Identity lifecycle management, secrets management, and workload identity security are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.
Published by the NHIMG editorial team on June 11, 2026.
Updated on October 8, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org