Reauthorisation

What reauthorisation is for

Reauthorisation exists to answer a simple but important control question: should this access still exist? It is the periodic checkpoint that prevents permissions from becoming stale after a role change, project end, transfer, vendor offboarding, or risk increase. In practice, it turns access review into an ongoing governance control rather than a one-time approval.

That recurring check matters because access often outlives the original business reason for granting it. When organisations do not revisit permissions, they accumulate entitlement drift, unnecessary privilege, and a larger review burden later. Reauthorisation is therefore less about granting new access and more about proving that current access remains justified.

How reauthorisation fits into access lifecycle governance

Reauthorisation sits inside the broader identity lifecycle, alongside provisioning, changes in job function, and revocation. It is the point where the organisation revalidates ownership, business need, and the level of privilege actually in use. The stronger the surrounding lifecycle process, the less reauthorisation becomes a paperwork exercise and the more it functions as a real control.

For access governance, the key distinction is between approval at the start and accountability over time. Initial approval answers whether access was appropriate then; reauthorisation answers whether it is still appropriate now. That is why mature programmes tie the control to entitlement owners, role changes, and review cadence, rather than treating it as an isolated audit task.

What reauthorisation should evaluate

A useful reauthorisation review asks whether the access still matches the person or system’s duties, whether the privilege level is still proportionate, and whether there is a valid current owner for the entitlement. It should also consider whether the access is still needed for the specific business process, whether the account has gone dormant, and whether compensating controls are hiding an unnecessary entitlement.

Reauthorisation is strongest when the reviewer can see the real-world context behind the entitlement, not just a list of permissions. A role label alone does not prove necessity. The control works best when it is anchored in actual job function, service purpose, and change history, so that outdated access can be removed before it becomes normalised.

Why reauthorisation matters in mature IAM programmes

Reauthorisation reduces the chance that access becomes permanent by default. It gives organisations a routine mechanism to catch privilege creep, inherited access that no longer fits the role, and accounts that remain active after a change in responsibility. Done well, it also improves auditability because the organisation can show that access decisions were revisited on a defined schedule.

It is also a practical control for limiting accumulated exposure. Over time, every exception, temporary grant, and inherited entitlement increases the surface area that must be defended. Reauthorisation helps reset that surface area back toward what is genuinely required, which is why it belongs in both governance reporting and day-to-day access administration.

Risk and Threat Considerations

Reauthorisation becomes a control failure when it is delayed, superficial, or disconnected from actual job and privilege changes. In that state, stale access can persist long after the original need has vanished, giving insiders or intruders a larger and longer-lived opportunity to misuse permissions.

Failure mechanism: If periodic review does not identify outdated or excessive access, the organisation keeps trusting entitlements that no longer match business need, which can hide privilege creep, dormant accounts, and unowned access paths.

Impact: Unnecessary access can increase the likelihood of unauthorized data exposure, misuse of privileged functions, and harder-to-detect lateral movement after an account or role is compromised.

Practitioner Guidance

Why practitioners should care: Reauthorisation is only valuable when it is treated as an operational control, not a calendar reminder. The most useful reviews are those tied to role changes, exception expiry, and explicit entitlement ownership, because those are the moments when access is most likely to become invalid.

Common misunderstanding: A signed-off access review is not the same as a meaningful reauthorisation decision if reviewers cannot see why the entitlement still exists. Practitioners should treat unexplained or repeatedly rubber-stamped access as a signal that the control design, not just the access itself, needs attention.