An authorization review is a check on whether a person or system still needs the access they have been given. It is a core control in identity governance because it reduces standing access risk and helps organisations identify over-provisioning. Automated reviews are faster and more consistent than manual ones.
Expanded Definition
An authorization review is a recurring validation of whether an identity still needs its current entitlements, with special importance for service accounts, API keys, workloads, and delegated automation. In NHI governance, the review is not just about confirming a named owner; it is about proving that each permission still matches an active business or technical purpose.
Definitions vary across vendors on whether the term includes attestation, recertification, or entitlement cleanup, but the operational goal is consistent: reduce standing access and remove privilege that no longer has a defensible justification. That makes it closely related to NIST SP 800-53 Rev 5 Security and Privacy Controls, especially access review and least privilege expectations.
In practice, strong reviews are evidence-driven, time-bound, and tied to asset or application ownership rather than generic identity lists. The most common misapplication is treating an authorization review as a checkbox approval that confirms ownership without verifying whether the access is still required for the current workload or process.
Examples and Use Cases
Implementing authorization review rigorously often introduces operational friction, requiring organisations to balance tighter access control against the time needed for owners to validate exceptions and edge cases.
- A platform team reviews privileged CI/CD service accounts quarterly and removes permissions tied to retired deployment pipelines.
- A security team uses the Ultimate Guide to NHIs as a governance reference when designing reviews for API keys that are still active but rarely used.
- An application owner certifies that a database integration account no longer needs write access after a migration to read-only reporting.
- A compliance team aligns review cadence with NIST SP 800-53 Rev 5 Security and Privacy Controls to evidence periodic access validation for sensitive systems.
- A cloud operations group flags dormant automation tokens during a review and routes them to rotation or revocation instead of simple reapproval.
Why It Matters in NHI Security
Authorization review matters because NHI risk compounds quickly when access is left untouched. NHIMG reports that 97% of NHIs carry excessive privileges and only 5.7% of organisations have full visibility into their service accounts, which means review discipline is often the only practical way to discover over-provisioning before it becomes exploitable. That urgency is reinforced in the Ultimate Guide to NHIs, where excessive privilege and poor visibility are shown as persistent systemic weaknesses.
When reviews are weak, expired entitlements stay active, dormant integrations keep broad access, and false assumptions about ownership delay remediation. That creates direct exposure to lateral movement, data access abuse, and recovery drag after incidents. The control also supports broader governance expectations in NIST SP 800-53 Rev 5 Security and Privacy Controls, where access governance must be demonstrable rather than implied.
Organisations typically encounter the real cost of authorization review only after a breach, failed audit, or outage reveals that an identity retained access long after its business need ended, at which point the term becomes operationally unavoidable to address.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 address the attack and risk surface, while NIST CSF 2.0 and NIST SP 800-63 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-02 | Authorization review reduces excessive privilege and stale access, a core NHI governance concern. |
| NIST CSF 2.0 | PR.AC-4 | Access permissions must be managed and reviewed to maintain least privilege. |
| NIST SP 800-63 | Identity assurance depends on current, justified access rather than stale entitlements. |
Review NHI entitlements regularly and remove access that no longer has an active business or technical need.
Related resources from NHI Mgmt Group
- Why do AI-generated authorization policies still need human review?
- What should organisations review before adopting signal-driven authorization?
- How do central authorization logs help with compliance and incident review?
- How should teams review authorization policy when business users cannot read policy files?
Deepen Your Knowledge
Reviewed and updated by the NHIMG editorial team on August 26, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org
