TL;DR: User access reviews are a useful compliance starting point, but Zluri argues they cannot deliver continuous governance because access changes between review cycles, coverage often stays limited to a few apps, and manual review alone cannot sustain least privilege across modern environments. The real control problem is lifecycle and monitoring, not periodic certification.
At a glance
What this is: This article argues that user access reviews are useful but insufficient, because identity governance needs continuous control over changing entitlements, application coverage, and lifecycle events.
Why it matters: For IAM and IGA teams, the message is that certification alone does not prevent privilege drift, so access governance must extend into automated provisioning, monitoring, and broader app coverage.
Context
User access reviews are a point-in-time governance control, not a full identity programme. They help show that access is being checked, but they do not continuously prevent entitlement drift when employees change roles, join, leave, or move across systems.
The governance gap is straightforward: least privilege is a moving target in modern environments. If reviews only cover a subset of applications or run on a quarterly cycle, the organisation can still carry stale or excessive access between certification points.
Key questions
Q: What breaks when access reviews are the only IGA control?
A: They create a governance gap between review cycles. Access can change through promotions, transfers, or terminations after certification, so the organisation may still carry stale or excessive access until the next scheduled review. That is why access reviews need provisioning, deprovisioning, and monitoring around them, not just manager approval.
Q: Why do user access reviews so often fail to enforce least privilege?
A: They fail when reviewers are asked to judge too many permissions with too little context. In that situation, managers rubber-stamp access, risky entitlements stay open, and the review becomes a compliance exercise instead of a control. Least privilege only works when the review workflow shows what matters and removes the friction that pushes people toward approval by default.
Q: How should security teams reduce manual effort in access certification campaigns?
A: Security teams should automate reviewer routing, reminders, approval tracking, and removal handling so the certification process produces reliable evidence instead of spreadsheet churn. The goal is not only speed but consistency, because a workflow-controlled review is easier to audit and less likely to miss excessive access or delayed revocations.
Q: How should teams move from periodic access reviews to continuous governance?
A: Start by identifying the identity events that already occur in your environment, such as joiner, mover, leaver, entitlement change, and ownership change events. Then connect those signals to policy-driven workflows so routine decisions happen automatically and only risky exceptions reach human reviewers. The aim is fewer batch reviews and faster control action.
Technical breakdown
Why point-in-time access reviews miss entitlement drift
User access reviews validate access after the fact. That makes them useful for audit evidence, but weak as a continuous control because entitlement state changes faster than review cadence. In practice, role changes, promotions, terminations, and app sprawl can all create a window where access is technically approved at the last review but no longer appropriate today. This is a governance timing problem, not just a process gap. Continuous IGA closes that timing gap by coupling review with event-driven monitoring and automated deprovisioning logic.
Practical implication: tie access decisions to lifecycle events and not just review cycles.
Why limited application coverage creates false confidence
A review programme that focuses only on in-scope or high-value applications can look mature while leaving large parts of the environment unmanaged. That matters because risk does not stop at the audit boundary. SaaS tools, cloud services, and long-tail business apps can still accumulate excessive access, and those entitlements can later become the easiest route to misuse or lateral privilege creep. Coverage is therefore an architecture issue as much as a governance one: the control only works where the identity platform can see and enforce it.
Practical implication: expand review scope beyond compliance-driven systems to the full application estate.
How RBAC, ABAC, and lifecycle workflows reduce manual review burden
Role-based access control and attribute-based access control reduce the number of one-off decisions managers have to make during review. Instead of asking reviewers to police every entitlement individually, the organisation can define access patterns that are tied to job function, department, location, or other attributes. That does not eliminate certification, but it shifts the centre of gravity from manual approval to governed policy. User lifecycle workflows then handle joiner, mover, and leaver events so access is granted and removed with less delay and less human error.
Practical implication: use policy-driven access models to reduce dependency on manual certification alone.
NHI Mgmt Group analysis
Access reviews are a control checkpoint, not an identity governance operating model. The article is right to frame UAR as a starting point, because certification proves oversight but not continuity. A mature IGA programme has to connect approvals, provisioning, monitoring, and revocation into one lifecycle, otherwise the organisation is simply proving it can inspect drift after it has already occurred. The practitioner conclusion is that governance must be built around state change, not annual or quarterly assurance rituals.
Point-in-time certification leaves a trust gap between reviews. That gap matters because identity state changes continuously in modern enterprises, while manual review cycles do not. The control assumption being challenged here is that access remains stable long enough to be meaningfully certified; in practice, job changes and application sprawl break that assumption. Practitioners should treat review cadence as one signal inside a broader governance system, not as the system itself.
Coverage depth matters as much as review rigor. A clean review process over a small set of critical applications can create a misleading sense of control if the rest of the estate is excluded. True least privilege has to extend across cloud services, SaaS, and the broader business application landscape, or risk simply migrates outside the review boundary. The practitioner takeaway is to measure governance by estate coverage, not by completion rates alone.
Lifecycle automation is the practical bridge between governance intent and access reality. Joiner, mover, and leaver processes turn governance rules into timely access change. Without them, reviewers are always looking at yesterday’s entitlement picture, and managers may either over-approve or under-provision based on stale context. The conclusion is that automated provisioning and deprovisioning are not optional add-ons to UAR; they are what make UAR operationally meaningful.
Continuous monitoring is the missing signal layer for modern IGA. Periodic review can confirm whether access was acceptable at a point in time, but it cannot detect segregation-of-duties violations or anomalous entitlement drift as it happens. That is why event-driven triggers and ongoing analytics belong alongside certification. The practitioner conclusion is simple: if governance cannot see state changes between reviews, it cannot claim continuous control.
From our research library:
- Over 70% of organisations lack automated access risk analysis, user access reviews and provisioning and deprovisioning, according to Pathlock's 2025 Digital Transformation and Access Risk Report.
- Read next: NHI Lifecycle Management Guide
What this signals
Continuous governance is the real control objective: access reviews are evidence of oversight, but they do not by themselves maintain entitlement accuracy between business events. Organisations that rely on certification alone are measuring control activity rather than control effect, which is why lifecycle automation has to sit alongside review.
Governance scope should follow the application estate, not the audit boundary: when reviews only cover a few systems, risk simply moves to the applications that were left outside the process. The practical signal for IAM and IGA teams is whether the programme can see and govern access everywhere the business actually operates.
For practitioners
- Implement event-driven provisioning and deprovisioning Connect joiner, mover, and leaver events to automated access changes so role changes and terminations update entitlements without waiting for the next review cycle.
- Expand review coverage beyond audit-scope applications Bring SaaS, cloud services, and other business-critical apps into the certification programme so least privilege is not measured only in the systems auditors already inspect.
- Shift high-risk access to policy-driven governance Use RBAC and ABAC to reduce manual reviewer burden, then reserve periodic certification for privileged or exceptional entitlements that still need human oversight.
- Add continuous monitoring for entitlement drift Track anomalous access, segregation-of-duties violations, and unexpected privilege accumulation between review cycles so the programme sees changes before they become findings.
Key takeaways
- User access reviews are useful for certification, but they do not by themselves keep entitlements current across a changing environment.
- The main weakness is coverage and timing, because access can drift between reviews and outside the applications that are actually in scope.
- IGA programmes need lifecycle automation and broader monitoring if they want least privilege to hold beyond a single review cycle.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 addresses the attack and risk surface, while NIST CSF 2.0, NIST SP 800-53 Rev 5 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-01 — Improper Offboarding | The article stresses joiner, mover, leaver handling and revocation gaps. |
| NHI-05 — Overprivileged NHI | The article centres on excess access and least privilege drift across systems. | |
| Recommendation — Automate offboarding and access removal so certifications are not the only revocation point. Review entitlement scope and remove access that exceeds current job need. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | This is fundamentally about governing entitlement accuracy and access scope. |
| Recommendation — Align access approvals and reviews to current permissions, entitlements, and authorizations. | ||
| NIST SP 800-53 Rev 5 | AC-6 — Least Privilege | The article argues periodic reviews alone do not maintain least privilege. |
| Recommendation — Enforce least privilege with policy and lifecycle automation, not reviews alone. | ||
| CIS Controls v8 | CIS-5 — Account Management | Account lifecycle management and review cadence are central to the article's theme. |
| Recommendation — Standardise account governance so changes are reflected promptly across the identity estate. | ||
Key terms
- User Access Review: A user access review is a periodic check that confirms each account still needs the access it has. In identity programs, the control is used to reduce excess privilege, support compliance, and catch access that has outlived its business need.
- Answer Drift: Answer drift is the gradual change in a model’s responses over time, often showing up as reduced consistency or increasing error rates. It can signal degraded grounding, shifting data quality, or prompt and retrieval issues. Monitoring drift helps teams catch reliability problems before they become widespread user-facing failures.
- Lifecycle Management: Lifecycle management is the process of creating, reviewing, rotating, and retiring identities and their secrets in a controlled way. For NHIs, it is essential because stale credentials, orphaned accounts, and incomplete offboarding are common paths to long-lived exposure and unauthorised access.
- Least Privilege: A security principle requiring that every identity, human or non-human, is granted only the minimum permissions necessary to perform its function. Least privilege is the single most effective control for reducing NHI blast radius.
Deepen your knowledge
Identity lifecycle management, secrets management, and workload identity security are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.
Published by the NHIMG editorial team on June 11, 2026.
Updated on October 8, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org