Access Request Drift is the gradual mismatch between approved access and current business need. In practice, users, service accounts, or AI agents keep permissions after roles, tasks, or risk conditions change. This creates unnecessary exposure unless access requests, approvals, and entitlement reviews are continuously reconciled with actual use.
How Access Request Drift Happens
Access request drift starts when approvals are treated as a one-time event rather than a living control. As roles change, projects end, or risk posture shifts, the original business justification can quietly stop matching the permissions that remain in place.
This is especially common where access is requested through multiple channels, such as tickets, manager approvals, temporary exceptions, or downstream system grants. The approval may be valid at the time, but the entitlement can outlive the need unless someone rechecks it against current duties and current use.
Why Access Request Drift Creates Security Exposure
The main danger is not the request itself, but the gap between the approved state and the actual operating state. That gap can leave dormant entitlements, overbroad permissions, or stale service access available long after the original task has changed.
When drift accumulates, organisations lose confidence that access reflects business need. That weakens least privilege, makes review evidence less reliable, and increases the chance that an account, secret, or delegated permission will be used in ways no longer justified.
How Organisations Detect and Correct Drift
Drift is easiest to spot when access records are compared with current job function, system usage, and entitlement ownership. The practical question is whether the approved access still matches what the user, service account, or agent actually does today.
Continuous reconciliation matters more than periodic approval alone. A request may have been legitimate when granted, but effective governance requires reconciling approvals, actual usage, and exceptions so outdated access can be flagged before it becomes normalised.
For a broader model of entitlement governance and access review, see IAM and IGA Basics.
Why Drift Matters for Non-Human Access as Well
Access request drift is not only a human-user problem. Service accounts, application permissions, and AI agents can also keep access long after the workflow, integration, or automation that justified them has changed.
That matters because non-human access is often less visible, less frequently reviewed, and more likely to be reused across systems. When the original need disappears, the remaining privilege can become an unnecessary standing permission that is harder to notice and harder to retire.
For a deeper look at the same problem in machine-access settings, see Salesloft OAuth token breach.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST SP 800-53 Rev 5 and CIS Controls v8 set the technical controls, while ISO/IEC 27001:2022 defines the regulatory obligations.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev 5 | AC-2 — Account Management | Access drift arises when account access outlives business need. |
| AC-6 — Least Privilege | Drift directly weakens least-privilege access by leaving excess permissions in place. | |
| AU-6 — Audit Review, Analysis, and Reporting | Usage review helps detect permissions that no longer match actual activity. | |
| Recommendation — Review and remove unnecessary account permissions as roles and needs change. Limit entitlements to the minimum access required for current duties. Use audit analysis to identify dormant or excessive access that should be corrected. | ||
| CIS Controls v8 | CIS-5 — Account Management | Account lifecycle control is central to preventing stale access from persisting. |
| Recommendation — Continuously govern account and entitlement changes through their full lifecycle. | ||
| ISO/IEC 27001:2022 | A.5.18 — Access rights | Access rights must be reviewed and adjusted as business need changes. |
| Recommendation — Recertify access rights so approvals stay aligned to current duties. | ||
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 23, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org