User access reviews at scale expose the governance breakpoints

At a glance

What this is: This guide explains why user access reviews that work initially often break under scale, with the article identifying visibility gaps, reviewer fatigue, and remediation delays as the main failure points.

Why it matters: It matters because identity teams cannot treat access reviews as a quarterly checkbox once application scope, ownership, and closure steps outgrow manual governance capacity.

By the numbers:

• The first review in the example took 3 weeks, involved 23 people, and revealed 87 apps.
• The article says one review surfaced 600 access violations.
• The article cites 149 person-days per cycle, nearly 3 FTEs, for access reviews.
• The article says manual processes often leave 50-70% of violations persisting weeks after reviews close.

Context

User access reviews are a governance control for confirming that people have the right access, but the control only works if the organisation can see the full application estate, assign the right reviewers, and close violations quickly. In this article, Zluri argues that scaling breaks the process long before the organisation runs out of reviewers.

The operational problem is accumulation. Each review cycle that depends on quarterly exports, manual routing, and ticket-based remediation creates a growing gap between discovered access and actually removed access, which turns the review into a documentation exercise rather than an effective control.

The article is aimed at organisations that have already completed a few access review cycles and now need to scale to larger application estates. That is a common maturity point, not an edge case, because many teams discover that execution is possible long before governance is sustainable.

Key questions

Q: What breaks when user access reviews rely on directory data alone?

A: Directory-only reviews miss apps and access paths that exist outside the identity provider, so the organisation certifies an incomplete estate. That creates false confidence, because the review is formally correct but operationally blind to shadow IT, direct SaaS use, and other live permissions that need governance.

Q: Why do access review backlogs keep growing even when reviews finish on time?

A: Backlogs grow when the decision is made during the review but the revocation is left to manual follow-up. If removals are not executed and verified quickly, unresolved violations carry into the next cycle and accumulate faster than the team can close them.

Q: How can security teams know whether access reviews are producing real control?

A: They should compare review outputs with live HR, IdP, and application state, then check whether drift keeps reappearing between cycles. If certifications routinely approve outdated roles or miss orphaned entitlements, the campaign is producing documentation rather than governance. Fresh data and post-review drift are the clearest indicators of control quality.

Q: Should organisations use group-based reviews or individual reviews for scale?

A: Use group-based review where access is already standardised and the group owner understands the entitlement set, then keep individual review for privileged, external, or directly assigned access. The right balance reduces decision volume without hiding exceptions that still need human judgment.

Technical breakdown

Why visibility gaps make review scope drift

A user access review depends on accurate scope, but scope is usually assembled from incomplete sources. Identity providers show provisioned access, while finance data, browser telemetry, CASB logs, API polling, and endpoint inventory often reveal more applications and more access paths than the directory alone. When discovery is periodic, the review is always lagging current usage. That creates a control gap: reviewers are certifying yesterday’s estate while new apps and permissions are already live. Conflict resolution across sources matters because a single source of truth is rarely enough once shadow IT and direct SaaS use are part of the environment.

Practical implication: Use multi-source discovery and conflict resolution before scaling review volume.

How remediation debt turns reviews into backlog

The review itself is only half the control. Once access is denied, the organisation still has to execute removal, verify completion, and prove that the violation no longer exists. If denials are exported to tickets and left for manual follow-up, the backlog grows with each cycle and unresolved items carry forward into the next review. The article’s numbers show the pattern clearly: outstanding violations can outpace closure, and the control stops reducing risk. Effective remediation needs the same governance as the review decision, including clear service levels, proof of completion, and escalation when tasks stall.

Practical implication: Tie every denial to a tracked closure path with verification and escalation.

Why reviewer fatigue weakens policy enforcement

Access reviews lose quality when reviewers are asked to process too many decisions without enough context. Once managers see the same names and the same application lists every cycle, approval rates rise and scrutiny falls. That is not a people problem alone, it is a design problem. Without usage context, risk classification, and rule-based automation for obvious approvals, the reviewer is forced to make repetitive judgments at scale. The result is policy drift: decisions become faster but less meaningful. A sustainable process reduces the number of manual decisions and reserves human review for exceptions, privileged access, and mismatches that actually need judgment.

Practical implication: Reduce repetitive approvals and reserve manual review for exceptions and high-risk access.

NHI Mgmt Group analysis

Access reviews fail when the estate being certified is smaller than the estate actually in use. The article’s discovery examples show that directory-based scoping can miss a large portion of the live application surface once SaaS sprawl, browser access, and finance signals are all in play. That is not merely incomplete data, it is a governance blind spot that makes certification decisions look valid while leaving real access untouched. Practitioners should treat scope integrity as the first control, not a reporting detail.

Remediation debt is the point where access reviews stop being a control and become a queue. If denials are not closed before the next cycle, the organisation is no longer measuring current risk, it is stacking unresolved exceptions on top of each other. Zluri’s article makes the operational consequence plain: manual closure creates a lag that can exceed the value of the review itself. The practitioner conclusion is that the review and the revocation path must be governed as one system.

Approval fatigue is a scaling signal, not a people issue. When approvers see too many repetitive decisions, accuracy degrades and policy enforcement weakens. That is the governance break point many teams miss, because higher throughput can disguise lower control quality. The article’s emphasis on context-rich automation is directionally right, but the deeper point is that access reviews need decision quality controls, not just workflow speed. Practitioners should measure how many decisions still require real judgment after automation is introduced.

Distributed ownership changes the economics of access review governance. Moving from per-user certification to group-based or risk-based governance changes who can meaningfully approve access and at what scale. That does not eliminate accountability, it makes accountability tractable by reducing the number of low-value decisions. For identity programmes, the lesson is to redesign governance around decision density rather than raw user count. That is the difference between periodic review theatre and operational control.

Continuous governance is becoming the practical endpoint for mature access review programmes. The article shows that quarterly batch review cannot keep pace with application growth, especially when new access can appear between review windows. The field implication is clear: teams that keep treating recertification as a periodic event will carry increasing risk debt, while programmes that move toward ongoing discovery, scoped certification, and automated closure will stay governable. Practitioners should plan for continuous control design, not just faster campaigns.

What this signals

Review scope has to move from directory completeness to estate completeness. Once application adoption outpaces manual scoping, the review programme should assume that new apps, browser-discovered tools, and finance-purchased SaaS will appear outside the IDP first. Identity teams need continuous discovery and reconciliation or the certification process will always trail the actual attack surface.

Closure time is now a first-class governance metric. A review that identifies violations but leaves them open for weeks is not reducing risk at the pace the business expects. Practitioners should measure time-to-remediate alongside approval rates, because slow closure turns access review into deferred risk management instead of control enforcement.

For practitioners

• Implement continuous multi-source discovery Connect identity, finance, browser, endpoint, and application data so the review scope reflects what is actually in use, not only what the directory shows.
• Set risk-based review scopes Classify applications by business criticality, regulatory exposure, and privilege level, then review the highest-risk apps more frequently than low-risk apps.
• Automate denial remediation with proof Route access removals through API workflows where possible, capture evidence of completion, and escalate unresolved denials before they roll into the next cycle.
• Reduce approval fatigue with grouping and exception handling Shift repetitive low-risk decisions into group-level or rule-assisted flows, and reserve manual review for privileged access, direct assignments, and flagged anomalies.
• Track closure time as a governance metric Measure how long violations remain open after a decision is made, because unresolved remediations are the clearest sign that the control is not closing risk.

Key takeaways

• User access reviews break down when scope, approval quality, and revocation workflows do not scale together.
• The article shows how incomplete discovery and delayed remediation can leave a large share of access risk unresolved between cycles.
• Practitioners should redesign reviews around continuous scope validation, risk-based selection, and verified closure.

Key terms

• User Access Review: A user access review is a periodic check that confirms each account still needs the access it has. In identity programs, the control is used to reduce excess privilege, support compliance, and catch access that has outlived its business need.
• Remediation Context Debt: Remediation context debt is the backlog created when organisations can detect issues but cannot attach enough ownership or business meaning to act decisively. The term describes a governance failure, not a tool gap, and it usually results in stale prioritisation and repeated exposure.
• Scope Integrity: Scope integrity means the review covers the full set of applications, entitlements, and identity relationships that actually exist in the environment. Without it, access reviews certify a partial estate and can miss shadow IT, direct assignments, or overlooked systems.
• Decision Density: Decision density is the amount of meaningful human judgment required per review cycle. When it is too high, approvers burn out, approvals become rubber stamps, and the programme needs grouping, automation, or exception handling to stay effective.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.