Why do manual PagerDuty access reviews miss governance gaps?

Why Manual PagerDuty Reviews Miss the Real Governance Problem

Manual access reviews are a snapshot of yesterday’s state, not a control over today’s change. PagerDuty access often shifts through role changes, team moves, on-call rotations, contractor turnover, and app integrations, so a reviewer can sign off on a record that is already stale. The gap is not just human error, it is the timing mismatch between governance and lifecycle.

That is why review programs that rely on periodic certification tend to find exceptions late, after the wrong entitlement has already been active long enough to matter. The control may still be useful for audit evidence, but it is weak as a primary mechanism for preventing excess access from accumulating between review cycles.

When teams treat the review as the control instead of a verification step, they also miss ownership problems. The question is not only whether a PagerDuty account exists, but whether its current access still matches the person, team, service, and escalation path that should own it now.

Where the Gap Appears in PagerDuty Access Governance

The governance gap usually shows up in three places: stale membership, stale role assignment, and stale integration access. A user may have moved teams after the last review, an on-call schedule may now be attached to the wrong group, or an API token may still be authorized even though the business need has changed.

Because PagerDuty is operational, these mismatches can persist quietly until an incident exposes them. That makes lifecycle linkage more important than calendar-based review, especially when access is inherited from identity groups or provisioned through connected systems rather than managed manually one account at a time.

In practice, the strongest controls are the ones that connect access to the event that just happened, such as onboarding, transfer, offboarding, schedule reassignment, or integration change. For broader governance patterns, NHIMG’s IAM and IGA Basics explains why certification alone is not enough when provisioning and entitlement changes move faster than review cycles. The same lifecycle logic is reinforced in the Joiner-Mover-Leaver (JML) Guide, which ties access changes to the business event that caused them.

How to Close the Timing Gap Without Losing Auditability

Effective PagerDuty governance usually combines event-driven provisioning with periodic attestation. Event-driven automation keeps the access state aligned to reality, while reviews provide a backstop for exceptions, inherited entitlements, and integration paths that do not cleanly follow HR or ticketing events.

That approach is stronger than asking reviewers to catch drift after the fact. It also creates a cleaner audit trail, because the evidence shows when the access was granted, why it changed, who approved it, and when it was removed if the user no longer needed it.

For teams building this control set, the most useful reference points are entitlement review, closed-loop remediation, and role ownership. NHIMG’s Access Reviews and Certification Guide is the clearest fit for how to structure review campaigns so they actually remove access, not just document it. Where access is bundled into broader entitlement models, Role Mining and Role Design Guide helps reduce role drift before it turns into review debt. If the environment has privilege boundaries or emergency access paths, Privileged Access Management Guide is the better lens for deciding when access should be time-bound rather than permanently assigned.

Risk and Threat Considerations

Manual reviews create a governance blind spot when access changes outpace the review cadence. That opens the door to excess privilege, orphaned access, and stale integrations that can still receive alerts, modify schedules, or expose incident data after the original business need has ended.

Failure mechanism: The reviewer validates a point-in-time record, but the entitlement, team membership, or integration permission changes again before the next review, so the control detects drift only after the exposure window has already existed.

Impact: Unauthorized or unnecessary PagerDuty access can survive long enough to create escalation misuse, incident-routing manipulation, or broader access sprawl across connected systems.

Practitioner Guidance

What to verify: Verify that every PagerDuty entitlement is owned by a current business role, not just by a named person, and that role changes automatically trigger review or deprovisioning. If the system cannot show when an entitlement was last justified, treat it as governance debt, not as approved access.

What good looks like: Good control design means access is updated at the event boundary, reviews are used to catch exceptions, and every remaining entitlement has a current owner and a clear removal path. The review process should be able to answer why the access exists now, not only why it existed when the campaign started.

Practitioner takeaway: Manual reviews are best treated as a detection layer for drift, not as the mechanism that keeps PagerDuty access correct in the first place.

Related resources from NHI Mgmt Group

• How should security teams run access reviews for non-human identities?
• When do NHI access reviews create more value than a one-time cleanup?
• What is the difference between role-based access and API key governance for NHI security?
• Why do AI agents create governance problems that normal access reviews miss?