Notifications
Clear all
Topic starter
25/08/2026 6:10 pm
TL;DR: Sequential, dual-party recertification creates more defensible decisions for high-privilege entitlements, sensitive applications, and audit-heavy environments, according to Veza’s explanation of multi-level access reviews, because separate reviewers can validate business need and access risk more reliably than a single approver. That matters because access review quality, not review volume, is what determines whether recertification actually controls blast radius.
NHIMG editorial — based on content published by Veza: multi-level access review capabilities for advanced access recertification
By the numbers:
- Only 5.7% of organisations have full visibility into their service accounts.
- 97% of NHIs carry excessive privileges, increasing unauthorised access and broadening the attack surface.
- Only 20% have formal processes for offboarding and revoking API keys, and even fewer have procedures for rotating them.
Questions worth separating out
Q: How should teams design access reviews for high-privilege entitlements?
A: Use separate reviewers with different context, such as a manager for business need and an owner for risk or entitlement scope.
Q: What breaks when access recertification is handled by one reviewer only?
A: Single-reviewer recertification often collapses business justification and risk validation into one judgment, which increases the chance of rubber-stamping.
Q: When does multi-level review add real value to IAM governance?
A: It adds the most value when access is privileged, sensitive, or subject to segregation-of-duties requirements.
Practitioner guidance
- Separate contextual approval roles Assign L1 to the manager or immediate business validator and L2 to the application, entitlement, or data owner so each reviewer brings distinct evidence to the decision.
- Use true sequential gating for high-risk entitlements Configure the workflow so L2 only receives rows that pass L1, and ensure rejection at the first stage stops the review before unnecessary downstream effort begins.
- Match decision mode to access risk Use unanimous approval for highly privileged or sensitive access, and reserve last decision only for cases where policy explicitly allows final approver override.
What's in the full article
Veza's full article covers the operational detail this post intentionally leaves for the source:
- The exact L1 and L2 reviewer assignment patterns for managers, application owners, and first-level reviewer managers.
- The configured decision modes that change how approvals, rejections, and last-decision authority behave in practice.
- The reporting outputs that document every review step for audit evidence and compliance review.
- The automation triggers that fire revocation or ticketing actions once the decision is locked in.
👉 Read Veza's explanation of multi-level access reviews for recertification →
Multi-level access reviews: are your recertifications defensible enough?
Explore further
25/08/2026 6:11 pm
Multi-level access review is an audit-control pattern, not a substitute for entitlement hygiene. Sequential approval improves decision defensibility, but it does not fix the underlying problem of over-entitled access. If the underlying entitlement graph is already inflated, a better review process can still end in a better documented bad decision. Practitioners should treat dual control as a governance layer on top of entitlement cleanup, not as a replacement for it.
A few things that frame the scale:
- Only 5.7% of organisations have full visibility into their service accounts, according to Ultimate Guide to NHIs.
- Only 97% of NHIs carry excessive privileges, according to Ultimate Guide to NHIs , Key Challenges and Risks.
A question worth separating out:
Q: Who should be accountable when an access review is completed but risky access remains?
A: Accountability sits with the identity governance owner, the business reviewer, and the control design that allowed high-volume certification to substitute for judgment. Frameworks such as the NIST Cybersecurity Framework and lifecycle governance models expect controls to reduce risk, not merely record activity.
👉 Read our full editorial: Multi-level access reviews close the audit gap in recertification
