Topic starter
12/02/2026 3:40 pm
TL;DR: Manual user access reviews are turning compliance work into repetitive approval traffic, and Lumos argues that dynamic access controls, JIT access, AI-driven prioritisation, and workflow automation can reduce the burden while preserving audit evidence, according to Lumos. The deeper issue is that review volume is outpacing governance design, so access control must become more adaptive upstream.
Editorial analysis by NHI Mgmt Group, based on content published by Lumos: “Click Fatigue is Killing Access Reviews—Here’s What to Do About It”.
Key questions
Q: What breaks when user access reviews become too large to manage manually?
A: Manual access reviews stop functioning as a meaningful control when reviewers cannot process the volume with enough context or time.
Q: Why do access reviews stall in larger identity programmes?
A: Access reviews stall when reviewers lack context, administrators cannot see bottlenecks, and the workflow forces people to jump between tools to decide.
Q: How do organisations know if access certification is actually working?
A: Look for shrinking numbers of standing privileges, faster revocation after review decisions, and fewer orphaned or overprivileged accounts over time.
Practitioner guidance
- Prioritise policy-level access governance Review roles and attributes first, then certify only the exceptions that cannot be resolved through policy design or automated rules.
- Reduce standing access with time-bound grants Shift sensitive access to request-based, time-limited approvals so routine entitlements do not accumulate into every review cycle.
- Automate remediation after review decisions Connect review outcomes to provisioning and deprovisioning workflows so approved removals are enforced across SaaS, cloud, and on-prem systems.
Bottom line: Manual user access reviews fail when review volume, context gathering, and remediation all depend on the same overworked human approval loop.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 2 days ago by NHI Mgmt Group
08/10/2026 5:42 pm
Click fatigue is an access governance failure, not a reviewer discipline problem. The article shows that manual certification breaks down when volume overwhelms the humans expected to validate it. That means the control is being asked to do more than its design can support, so errors and rubber-stamping become predictable. The practitioner conclusion is that review capacity must be engineered into the governance model, not assumed.
A few things that frame the scale:
- 69% of security leaders agree identity management must fundamentally shift to address agentic AI systems, according to the 2026 Infrastructure Identity Survey.
- Over 70% of organisations lack automated access risk analysis, user access reviews and provisioning and deprovisioning, according to Pathlock's 2025 Digital Transformation and Access Risk Report.
A question worth separating out:
Q: What should security teams do after a reviewer approves removal of access?
A: They should ensure the removal is enforced in the downstream systems that actually hold the entitlement and that the action is captured as audit evidence. A review decision that is not executed everywhere it matters leaves residual access in place. Governance should therefore connect certification, deprovisioning, and reporting in one controlled workflow.
👉 Read our full editorial: Click fatigue is weakening access reviews across identity programmes