Topic starter
08/06/2026 4:23 pm
TL;DR: C1.ai says Treasure Data’s user access review programme moved from sporadic spreadsheet checks and 160 annual hours to intelligent, risk-scoped reviews with automated conflict detection, broader entitlement coverage, and faster remediation. The real shift is that review maturity now depends on continuous depth and exception handling, not campaign volume alone.
Editorial analysis by NHI Mgmt Group, based on content published by C1.ai: “How Treasure Data Transformed User Access Reviews with C1”.
Key questions
Q: What breaks when user access reviews stay spreadsheet-based?
A: Spreadsheet-based reviews break because they capture a stale snapshot, hide effective permissions, and rely on human follow-up for enforcement.
Q: When should teams prioritise scoped reviews over full access campaigns?
A: Teams should prioritise scoped reviews when the access estate includes privileged accounts, external users, inactive users, or unused permissions that a full campaign would handle too broadly.
Q: Why do access reviews often fail to reduce real risk?
A: Access reviews often fail when they produce evidence without changing the underlying entitlement state.
Practitioner guidance
- Define review scope by entitlement risk Prioritise privileged access, external accounts, inactive users, unused permissions, and sensitive groups before expanding to low-risk access populations.
- Replace spreadsheet certification with workflow-linked exceptions Route flagged access issues directly into ticketing or case management so reviewers can track ownership and closure instead of exporting findings manually.
- Use conflict detection for continuous monitoring Trigger alerts when high-risk entitlements or policy conflicts appear between campaigns, so review controls catch change as it happens.
Bottom line: Manual user access reviews often create compliance evidence without materially improving access governance, especially when scope is limited to whatever can be exported quickly.
What's in the full article
C1.ai's full blog covers the operational detail this post intentionally leaves for the source:
- The step-by-step transition from ad-hoc spreadsheet checks to quarterly structured access review campaigns.
- Specific examples of the entitlement types Treasure Data expanded into, including privileged access and inactive users.
- The workflow mechanics for turning exceptions into Jira tickets and shortening remediation time.
- The roadmap toward phase 4, including RBAC matrix design and real-time exception-based alerts.
👉 Read C1.ai's analysis of Treasure Data’s user access review maturity journey →
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
08/06/2026 6:00 pm
Access review maturity is defined by depth, not campaign frequency: Quarterly certification alone does not tell you whether the programme is actually governing access risk. Once an organisation can review broader entitlement classes, surface conflicts in real time, and push exceptions into workflow, the control starts to behave like governance rather than bookkeeping. The practitioner conclusion is that frequency without scope is a weak maturity signal.
A few things that frame the scale:
- Over 70% of organisations lack automated access risk analysis, user access reviews and provisioning and deprovisioning, according to Pathlock's 2025 Digital Transformation and Access Risk Report.
A question worth separating out:
Q: How should IAM teams connect access reviews to RBAC and JIT access?
A: IAM teams should use review findings to simplify roles, remove recurring exceptions, and identify where standing privilege can be replaced with just-in-time access. Reviews should not sit apart from entitlement design. They should inform how access is provisioned, narrowed, and removed over time.
👉 Read our full editorial: Treasure Data’s user access review maturity shows why depth matters