Topic starter
06/07/2026 9:39 am
TL;DR: About 50 IT tickets per week were redirected and access-request handling improved by linking requestors directly to approvers, while keeping audit trails and least privilege in place, according to Lumos. The real issue is not ticket volume but whether access governance can stay accountable as approval paths become more distributed.
Editorial analysis by NHI Mgmt Group, based on content published by Lumos: “How Lumos Uses Lumos to Empower End Users with Self-Service”.
Key questions
Q: How should IAM teams improve access request governance without adding friction?
A: Start by simplifying the request model, not by adding more approval layers.
Q: Why can user access reviews fail even when the process is completed on time?
A: They fail when the reviewer lacks ownership context or cannot judge whether the entitlement still fits the business need.
Q: What are the biggest governance mistakes in self-service access workflows?
A: The most common mistakes are vague entitlement descriptions, incorrect approver routing, and treating ticket reduction as a security metric.
Practitioner guidance
- Standardise approver assignment Define which app owner or business role is authorised to approve each entitlement, and keep that mapping current as applications and teams change.
- Audit user access review quality Sample completed reviews for evidence that the reviewer understood the entitlement and business need, not just that the review was closed.
- Tighten entitlement descriptions Rewrite catalogue entries so requestors and approvers can see the exact access being requested, which limits vague or bundled approvals.
Bottom line: Self-service access reviews can reduce operational friction, but they also expose whether governance ownership is explicit enough to survive decentralised approvals.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
06/07/2026 9:54 am
Self-service access reviews do not eliminate governance friction, they relocate it. The central question is whether decision authority can be pushed outward without weakening evidence quality. When requestors, app owners, and IT all participate, the control plane becomes more distributed, so the governance burden shifts from queue management to ownership discipline and auditability.
A few things that frame the scale:
- 97% of NHIs carry excessive privileges, increasing unauthorised access and broadening the attack surface, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: When does decentralised access approval create more risk than it removes?
A: It creates more risk when approvers are overloaded, untrained, or disconnected from the entitlement they are approving. In that case, self-service becomes a faster way to approve bad decisions. Decentralisation only helps when ownership is clear and the approval evidence is defensible.
👉 Read our full editorial: Self-service access reviews expose the next IAM governance gap