What breaks when access reviews and segregation of duties are still handled manually at enterprise scale?

Why This Matters for Security Teams

Manual access reviews and segregation of duties checks are designed to stop privilege creep, but at enterprise scale they often become a paperwork exercise. When identity sprawl is already high, reviewers are forced to make decisions from stale screenshots, incomplete entitlement exports, and inconsistent manager input. That creates gaps between policy and actual access, especially for service accounts, API keys, and automation-heavy workflows.

This is more than an efficiency issue. The scale problem is visible in NHI programs where NHIs now outnumber human identities by 144:1, which means the review burden is no longer human-sized. Guidance from the OWASP Non-Human Identity Top 10 and NIST SP 800-53 Rev. 5 points to access governance as a control function, not a once-a-quarter administrative task. In practice, many security teams discover toxic combinations only after a privileged account is already used for lateral movement or a regulator asks for evidence that cannot be reconstructed cleanly.

In practice, many security teams encounter review failures only after access has already been abused, rather than through intentional pre-emptive control design.

How It Works in Practice

The operational issue is that manual review processes cannot keep pace with continuously changing identity state. A user may gain access through a ticket, inherit permissions through group nesting, keep an old role after a project ends, and then receive temporary elevated access for an urgent fix. If segregation of duties is checked by humans at month-end, the conflict may exist for weeks before anyone notices.

At enterprise scale, effective control design shifts from periodic review to continuous entitlement evaluation. That means integrating IAM, PAM, HR, ticketing, and application logs so the control can see who has access, why it exists, when it was granted, and whether it still matches job function. Where automation is mature, reviewers focus on exceptions and business justification, while policy engines handle the routine matching of roles, entitlements, and SoD rules. This is closer to how NHI lifecycle management works in practice: issuance, review, renewal, and revocation must be tied together rather than treated as separate governance chores.

• Use machine-readable entitlements and SoD rules, not spreadsheet reconciliations.
• Trigger reviews on lifecycle events such as role changes, access grants, and offboarding, not just calendar dates.
• Prioritise privileged and non-human identities first, because they scale faster and create broader blast radius.
• Retain evidence automatically so auditors can trace approval, renewal, and revocation decisions.

For framework alignment, the strongest mapping is to the identity and access family in NIST SP 800-53 Rev. 5, especially continuous monitoring and account management expectations, while Ultimate Guide to NHIs highlights why the NHI population makes manual governance untenable. These controls tend to break down in decentralised enterprises with multiple business units and shared platform teams because no single reviewer has a complete, current view of effective access.

Common Variations and Edge Cases

Tighter access governance often increases review overhead, requiring organisations to balance control depth against operational speed. That tradeoff becomes sharper where access is highly dynamic, such as DevOps, cloud operations, and AI-enabled tooling.

There is no universal standard for manual SoD handling that works well at scale. Current guidance suggests that teams should not rely on annual certifications alone when access changes daily, but the exact cadence and automation depth depend on risk tolerance and regulatory pressure. Some environments still need human approval for sensitive entitlements, yet the review itself should be driven by policy evidence rather than free-text justification. This is especially true when secrets live outside traditional vaults or when third parties hold persistent access, which is common in environments described in Ultimate Guide to NHIs — Key Challenges and Risks and the 52 NHI Breaches Analysis.

The main edge case is exception-heavy operations, such as incident response or emergency maintenance, where temporary rule breaks are legitimate. In those cases, best practice is evolving toward time-boxed approvals with automatic expiry, not open-ended exceptions. Manual controls still have a role for final adjudication, but if every review depends on people reading exports and reconciling conflicts by hand, the control will lag behind the environment it is meant to govern.

Related resources from NHI Mgmt Group

• What breaks when vendor access reviews are handled manually at scale?
• What breaks when access management is still handled manually?
• What breaks when key rotation and access control are handled manually at scale?
• What breaks when DLP exception reviews are handled manually at scale?