Topic starter
25/06/2026 3:03 pm
TL;DR: AI is being used to reduce reviewer fatigue in access certifications by flagging unusual entitlements, grouping low-risk items, and supporting faster decisions, according to SecurEnds. The shift matters because access review quality, not just completion, is now the real audit and governance problem.
Editorial analysis by NHI Mgmt Group, based on content published by SecurEnds: “AI in User Access Reviews: Can Machine Learning Reduce Reviewer Fatigue”.
Key questions
Q: What breaks when access certification is handled with ad hoc manual reviews?
A: Ad hoc manual reviews usually break at scale.
Q: Why does reviewer fatigue create governance risk in access certification?
A: Reviewer fatigue matters because exhausted reviewers are more likely to approve broadly, miss stale access, and overlook privileges that no longer match the user’s role.
Q: How do organisations know whether access reviews are working?
A: Access reviews are working when they lead to timely removals, reduced exception volume, and role definitions that stop accumulating unused rights.
Practitioner guidance
- Define high-risk review thresholds Separate entitlements that deserve human scrutiny from routine items that can be grouped or deprioritised.
- Require explanation for every recommendation Make the AI rationale visible to reviewers and auditors so each flag, grouping, and suggested approval can be traced back to a clear access signal.
- Measure review quality, not just completion Track how often reviewers approve everything, how many exceptions are challenged, and how much stale or excessive access is uncovered after certification.
Bottom line: AI-assisted access review is aimed at reducing reviewer fatigue, but the real governance problem is whether certification remains meaningful under load.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
25/06/2026 4:20 pm
Manual certification has reached a scale limit: access review processes were designed for human review of manageable entitlement sets, not for repeated approval cycles where managers must decide quickly with incomplete context. When the queue grows, the control degrades into compliance theatre rather than governance. The implication is that access certification quality must be treated as a capacity problem, not only a process problem.
A few things that frame the scale:
- Over 70% of organisations lack automated access risk analysis, user access reviews and provisioning and deprovisioning, according to Pathlock's 2025 Digital Transformation and Access Risk Report.
A question worth separating out:
Q: Should AI replace human reviewers in access certification?
A: No. AI should support reviewers by sorting noise, surfacing anomalies, and recommending where to look first, but final certification still needs human accountability. Access review is a governance decision, not a pure classification problem. The best model is machine assistance with named human ownership of the outcome.
👉 Read our full editorial: AI in access review exposes the limits of manual certification