Topic starter
16/09/2026 9:21 am
TL;DR: SOC 2-style access reviews are difficult when IdP logs prove login but not why an application allowed or denied a specific tenant or resource action, according to PermitIO. The practical issue is authorization evidence, not authentication evidence, because reviewers need decision provenance that links identity, policy, resource, and result.
Editorial analysis by NHI Mgmt Group, based on content published by PermitIO: “Explainable Deny: Authorization Decision Evidence for SOC 2-Style Access Reviews”.
Key questions
Q: What breaks when access reviews rely only on IdP logs?
A: They cannot prove why an application allowed or denied a tenant- or resource-level action.
Q: Why is decision provenance important for SOC 2-style access reviews?
A: Because reviewers need a traceable chain from requester to policy to result.
Q: What are the signs that authorization evidence is too weak for audit?
A: The usual signs are scattered rule logic, unexplained exceptions, missing policy versions, and an inability to reconstruct a sampled decision without asking engineers to interpret code.
Practitioner guidance
- Document decision provenance fields Define the minimum authorization record for every sensitive action: subject, action, resource, tenant, policy version, matched rule, enforcement point, timestamp, and result.
- Separate authentication evidence from authorization evidence Map which logs prove login and which logs prove allow or deny decisions.
- Capture deny decisions as audit evidence Retain denied requests for sensitive actions, including the policy reason and the exact boundary that blocked the request.
Bottom line: Access reviews become difficult when teams can prove authentication but not authorization decisions.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
16/09/2026 9:21 am
Authorization evidence is now a control requirement, not a logging nice-to-have. Access review programmes fail when they treat identity proof as sufficient proof of access control. The article shows that reviewers need decision provenance because control effectiveness is judged at the point of authorization, not at login. Practitioners should treat application-level decision records as part of the evidence package, not as optional telemetry.
A few things that frame the scale:
- Over 70% of organisations lack automated access risk analysis, user access reviews and provisioning and deprovisioning, according to Pathlock's 2025 Digital Transformation and Access Risk Report.
A question worth separating out:
Q: How should security teams handle delegated access when AI agents act on behalf of customers?
A: Security teams should treat delegated access as a separate governance layer, not as a normal login session. Define what the agent can do, how much value it can move, which approvals are required, and how delegation is revoked. Without those boundaries, the agent inherits more authority than the customer intended and fraud risk expands quickly.
👉 Read our full editorial: Explainable deny for SOC 2 access reviews: why evidence matters