Business purpose
Why the fictional user or service identity needs access to a resource or workflow.
Review question: Access without a current purpose is difficult to defend even when it was once legitimate.
High School AdvancedA18.4Advanced Defensive Labs
Lesson A18.4
Identity Access Review Case
Access review is not a hunt for suspicious-looking permissions. It is a disciplined decision about whether each identity still has the right access, for the right reason, under the right owner, with current evidence.
Every identity, role, approval, exception, application, activity record, and decision in this lesson is fictional.
Lesson Progress
Identity Access Review Case
High School Advanced • A18: Advanced Defensive Labs • Lesson 4 of 10
40% complete
Readiness Check
A18.4 Entry Readiness
0/4 ready
Professional Hook
Unusual Access Is Not the Same as Unjustified Access
A rarely used account may be critical emergency access. A frequently used role may no longer match the user's job. A service identity may look broad until its application dependencies are reviewed. A temporary privileged overlap may be legitimate today and inappropriate three days later when its exception expires.
Good reviewers do not decide from appearance. They connect access to purpose, ownership, approval, time, dependency, monitoring, and business need.
Access review asks “Is this still justified?” before it asks “Does this look unusual?”
Learning Objectives
Five Capabilities for This Lab
1
Review fictional user, service, and privileged access using business purpose, role design, least privilege, approval evidence, review freshness, ownership, monitoring, and exception status.
2
Distinguish unusual access from unjustified access so decisions are based on evidence rather than role names, privilege level, or assumptions about intent.
3
Evaluate stale entitlements, conflicting owner records, overlapping roles, service identities, temporary exceptions, and missing review evidence using clear confidence and escalation rules.
4
Choose defensible retain, modify, remove, escalate, or evidence-insufficient outcomes while preserving necessary business access and avoiding unnecessary privilege expansion.
5
Build an Identity Access Review Decision Pack with evidence references, decisions, rationale, owners, review dates, exception status, monitoring needs, validation criteria, and leadership summary.
Identity Review Concepts
Ten Ideas That Shape an Access Decision
Least privilege
The identity should have only the access needed for its approved responsibility.
Review question: Ask whether narrower access would still support the required task.
Role design
Permissions are grouped around responsibilities rather than assigned randomly.
Review question: Check whether the role still matches the person's or service's current function.
Approval evidence
A current record shows who approved the access, for what purpose, and under what conditions.
Review question: Old approval may not prove current need after role, team, or service changes.
Access review freshness
The most recent access review is current enough to support today's decision.
Review question: Stale review evidence should lower confidence even if the technical access looks reasonable.
Ownership
A current owner is accountable for the resource, role, service identity, or exception.
Review question: Conflicting ownership can make approval and escalation unreliable.
Separation of duties
Certain responsibilities may need distinct roles so one person does not control incompatible stages without oversight.
Review question: Overlapping roles are not automatically wrong, but they require clear justification and governance.
Exception governance
Temporary deviation from the normal access model is documented, approved, bounded, monitored, and time-limited.
Review question: Expired or ownerless exceptions should not continue by inertia.
Service identity governance
Non-human identities need purpose, owner, permissions, dependency context, review, and monitoring.
Review question: Service identities should not become forgotten permanent privilege containers.
Monitoring evidence
Access use and important changes produce enough evidence for review.
Review question: Lack of visibility can change whether access should remain active or require compensating controls.
Decision Outcomes
Five Defensible Access Review Decisions
Retain
Use when: Access has a current business purpose, appropriate scope, current approval, current ownership, and no unresolved governance issue.
Evidence: Purpose, owner, role mapping, review date, approval, monitoring.
Modify
Use when: The identity still needs access, but the current role or scope is broader than necessary.
Evidence: Current responsibility, narrower role option, owner validation, impact of change.
Remove
Use when: The access no longer has a current approved purpose or clearly belongs to a former role or service dependency.
Evidence: Role change, service retirement, owner confirmation, no active exception.
Escalate
Use when: The access may be justified, but the decision requires higher authority, risk acceptance, or conflict resolution.
Evidence: Conflicting approvals, privileged overlap, exception request, unclear authority.
Evidence Insufficient
Use when: The case package does not yet establish enough current evidence to retain, modify, or remove access safely.
Evidence: Missing owner, stale approval, missing dependency, unresolved business purpose.
Identity Types
Different Identities Need Different Review Context
Standard user identity
Purpose: Supports ordinary fictional workforce tasks.
Review focus: Current role, team, application need, least privilege, approval, and inactivity.
Privileged user identity
Purpose: Supports bounded administrative or security responsibilities.
Review focus: Elevated role purpose, separation of duties, approval authority, review cadence, and monitored use.
Service identity
Purpose: Supports a fictional application or automation dependency.
Review focus: Owner, workload purpose, permission scope, dependency, review date, rotation/revocation governance, and monitoring.
Emergency access identity
Purpose: Supports exceptional continuity needs under explicit governance.
Review focus: Tight scope, explicit authorization, monitoring, review after use, and no routine dependence.
External collaborator identity
Purpose: Supports approved work with a fictional partner or contractor.
Review focus: Sponsor, end date, resource scope, business purpose, inactivity, and removal trigger.
Shared functional role
Purpose: Represents permission bundles assigned to eligible identities.
Review focus: Role purpose, membership criteria, owner, conflicting permissions, and review freshness.
Case File
Northbridge Synthetic Identity Evidence
IAM-1801USR-NB-14Standard userCurrent
User moved from Team Orion to Team Nova 42 days ago.
Confidence
High
Review concern
One Team Orion reporting role is still assigned.
IAM-1802USR-NB-14Role assignmentCurrent
ROLE-ORION-REPORT remains active and provides read-only access to fictional Orion dashboards.
Confidence
High
Review concern
Current Team Nova role description does not require Orion reporting access.
IAM-1803USR-NB-14ApprovalStale
Original approval for ROLE-ORION-REPORT is eight months old and references the user's former team.
Confidence
High
Review concern
Old approval does not prove current need.
IAM-1804ADM-NB-03Privileged userCurrent
Administrator holds both Cloud Platform Admin and Security Review Admin under exception EXC-I44.
Confidence
High
Review concern
Dual-role access is allowed only through the temporary exception.
IAM-1805EXC-I44ExceptionCurrent
Exception EXC-I44 expires in two days and includes enhanced review logging.
Confidence
High
Review concern
A decision is needed before expiration; no automatic extension is allowed.
IAM-1806SVC-NB-22Service identityCurrent
Service identity supports APP-NB-22 and has read access to DATA-NB-8 plus queue-update permission.
Confidence
High
Review concern
Permissions match the documented workload purpose.
IAM-1807SVC-NB-22OwnershipCurrent
Service identity owner is listed as Team Atlas in the current service registry.
Confidence
High
Review concern
Healthy ownership evidence.
IAM-1808SVC-NB-22ReviewStale
Last service identity access review was 15 months ago.
Confidence
High
Review concern
Technical scope appears reasonable, but governance evidence is stale.
IAM-1809EXT-NB-07External collaboratorCurrent
External collaborator sponsor is Team Atlas; project end date was 19 days ago.
Confidence
High
Review concern
No extension record is attached.
IAM-1810EXT-NB-07ActivityCurrent
No fictional sign-in activity has been recorded since five days before the project end date.
Confidence
High
Review concern
Supports review of whether access should be removed.
IAM-1811USR-NB-31Standard userCurrent
User has ROLE-FIN-READ and ROLE-OPS-READ.
Confidence
High
Review concern
The user's current role description mentions operations support but not finance reporting.
IAM-1812USR-NB-31Manager noteCurrent
Manager note says finance access may still be required for monthly reconciliation support.
Confidence
Moderate
Review concern
Purpose is plausible but not yet tied to a formal current approval.
IAM-1813ROLE-SEC-REVIEWRole definitionCurrent
Security Review role permits read-only access to fictional audit and control evidence.
Confidence
High
Review concern
Role itself appears appropriately bounded.
IAM-1814ROLE-CLOUD-ADMINRole definitionCurrent
Cloud Platform Admin can modify fictional platform configuration.
Confidence
High
Review concern
Elevated impact requires strong approval and separation-of-duties review.
IAM-1815BRK-NB-01Emergency identityCurrent
Emergency access identity has not been used in 211 days.
Confidence
High
Review concern
Inactivity is expected; review should focus on readiness, authorization, and monitoring rather than deleting it solely for low use.
IAM-1816BRK-NB-01GovernanceCurrent
Quarterly emergency-access review completed 17 days ago with owner and approver signoff.
Confidence
High
Review concern
Healthy governance evidence.
IAM-1817USR-NB-42Ownership conflictMixed
Application owner registry lists Team Quartz, while an older entitlement spreadsheet lists Team Delta as approver.
Confidence
High
Review concern
Approval authority should be resolved before changing access.
IAM-1818USR-NB-42Usage evidenceCurrent
The user accessed the fictional application twice in the last 30 days.
Confidence
High
Review concern
Usage shows activity, not necessarily business justification.
Fake Dashboard
Northbridge Identity Access Review Dashboard
Fictional access evidence, decision outcomes, stale governance, and safety posture
Identity evidence records
18
Users, roles, service identities, exceptions, approvals, ownership, and activity
Review decisions
7
Retain, remove, escalate, retain-with-review, and evidence-insufficient outcomes
Stale governance records
3
Former-team approval, service identity review, and mixed owner evidence
Real identities changed
0
All access review work remains fictional and evidence-based
Fake SOC Alert
Former-Team Role Still Assigned
Source: Fictional Identity Review Queue • Time: 10:16
USR-NB-14 moved from Team Orion to Team Nova 42 days ago, but ROLE-ORION-REPORT remains assigned. The only approval for that role references the user's former team and is eight months old.
Defensive recommendation: Confirm the current role does not require the access, then remove the stale entitlement while preserving required Team Nova access.
Fake Log Panel
Northbridge Fictional Identity Review Log
training-log-viewer.log
[08:10] IAM-1801 identity=USR-NB-14 team_change=ORION_TO_NOVA age=42_DAYS [08:28] IAM-1802 role=ROLE-ORION-REPORT state=ACTIVE current_need=NOT_DOCUMENTED [08:46] IAM-1805 exception=EXC-I44 expires_in=2_DAYS action=DECISION_REQUIRED [09:04] IAM-1808 identity=SVC-NB-22 review_age=15_MONTHS scope=DOCUMENTED [09:22] IAM-1809 identity=EXT-NB-07 project_end_age=19_DAYS extension=NONE [09:40] IAM-1812 identity=USR-NB-31 finance_need=POSSIBLE formal_approval=MISSING [09:58] IAM-1816 identity=BRK-NB-01 quarterly_review=PASS owner=CONFIRMED [10:16] IAM-1817 identity=USR-NB-42 approver_sources=CONFLICTING action=ESCALATE
Training note: this is fake data for defensive analysis practice only.
Review Decisions
Seven Evidence-Linked Access Decisions
DEC-1801Remove
USR-NB-14 / ROLE-ORION-REPORT
Evidence
IAM-1801, IAM-1802, IAM-1803
Rationale
The user changed teams, the former-team role is not required by the current role description, and the only approval references the former job context.
Confidence
High
Owner
Application Access Owner
Validation
Confirm the role is no longer assigned and Team Nova access remains unaffected.
DEC-1802Escalate
ADM-NB-03 dual privileged roles
Evidence
IAM-1804, IAM-1805
Rationale
The access is currently approved but depends on a temporary exception that expires in two days.
Confidence
High
Owner
Identity Governance Owner
Validation
Record explicit close, renew, or redesign decision before expiration.
DEC-1803Retain with Review
SVC-NB-22
Evidence
IAM-1806, IAM-1807, IAM-1808
Rationale
The service identity has clear purpose and appropriate scope, but its formal access review is stale.
Confidence
Moderate to High
Owner
Team Atlas Service Owner
Validation
Complete a current review and confirm permissions still match APP-NB-22 dependencies.
DEC-1804Remove
EXT-NB-07
Evidence
IAM-1809, IAM-1810
Rationale
The sponsored project ended, no extension exists, and no recent activity supports ongoing need.
Confidence
High
Owner
External Access Sponsor
Validation
Confirm external membership is removed and no active project dependency remains.
DEC-1805Evidence Insufficient
USR-NB-31 / ROLE-FIN-READ
Evidence
IAM-1811, IAM-1812
Rationale
A current manager note suggests possible need, but formal purpose and approval evidence are incomplete.
Confidence
High
Owner
Finance Application Owner
Validation
Obtain current business justification and approval before retaining or removing.
DEC-1806Retain
BRK-NB-01
Evidence
IAM-1815, IAM-1816
Rationale
Low usage is expected for emergency access, and current quarterly governance evidence supports the design.
Confidence
High
Owner
Platform Resilience Owner
Validation
Continue scheduled review and monitoring without using routine activity as the success measure.
DEC-1807Escalate
USR-NB-42
Evidence
IAM-1817, IAM-1818
Rationale
Current access is being used, but the case contains conflicting owner and approver evidence.
Confidence
High
Owner
Identity Governance Owner
Validation
Resolve current application ownership and approval authority before changing access.
Analyze the Evidence
Evidence Analysis: Former-Team Access
USR-NB-14 moved from Team Orion to Team Nova 42 days ago.
ROLE-ORION-REPORT is still active.
The role is read-only.
The user's current Team Nova job description does not require Orion reporting.
The only approval references the former Team Orion position.
What is the strongest access-review decision for USR-NB-14?
Evidence Interpretation
Avoid Turning One Signal Into the Whole Decision
A privileged account has not been used recently.
Weak conclusion
Unused privileged access should always be deleted.
Stronger conclusion
Review business purpose, emergency function, owner, approval, monitoring, and readiness before deciding.
A user signs in frequently.
Weak conclusion
Frequent use proves the access is necessary.
Stronger conclusion
Usage proves activity, not business justification; current purpose and approval still matter.
A role was approved last year.
Weak conclusion
The role is still justified.
Stronger conclusion
Old approval shows historical legitimacy but may not support current need after role or service changes.
A service identity has broad-looking permissions.
Weak conclusion
The identity is definitely overprivileged.
Stronger conclusion
Compare permission scope with workload dependencies, owner, review date, and whether narrower access would still work.
Two roles overlap.
Weak conclusion
The combination is automatically prohibited.
Stronger conclusion
Review separation-of-duties intent, exception status, business need, monitoring, and approval.
An external collaborator's project ended.
Weak conclusion
The account itself must be suspicious.
Stronger conclusion
The access likely needs removal unless a current sponsor and extension justify continued need.
Stale Access
Six Patterns That Commonly Create Access Drift
Former-team role remains
Signal: Identity changed jobs or teams but one prior role remains active.
Risk: Access may outlive its original business purpose.
Response: Validate current need and remove or modify if the old role no longer applies.
Project access after end date
Signal: External or temporary access remains after the approved work ended.
Risk: Time-bounded access may become indefinite.
Response: Require current sponsor and extension or remove access.
Service identity review overdue
Signal: Workload identity still functions, but governance review is stale.
Risk: Permissions may drift unnoticed as dependencies change.
Response: Revalidate purpose, scope, owner, dependency, and monitoring.
Role owner changed
Signal: Current resource owner differs from older approval records.
Risk: Review decisions may rely on outdated authority.
Response: Resolve current ownership before making material access changes.
Exception near expiration
Signal: Temporary privileged overlap remains active close to its end date.
Risk: The exception may continue without a deliberate decision.
Response: Close, renew, or redesign before expiration.
Usage without purpose
Signal: The identity actively uses access but the business justification is missing.
Risk: Activity can normalize access that no longer has approved purpose.
Response: Obtain current purpose and approval instead of using usage alone as justification.
Prioritization
Eight Factors That Shape Access Review Priority
Privilege level
How much authority could the identity exercise within the fictional environment?
Data sensitivity
Does the access reach internal, restricted, financial, or sensitive evidence?
Business criticality
Would incorrect removal or retention disrupt an important service or process?
Evidence freshness
Are purpose, owner, approval, and review records current?
Exception status
Is access operating under a temporary approved deviation, and when does it expire?
Separation of duties
Could the role combination weaken independent review or approval?
Monitoring quality
Would important use or change activity be visible to reviewers?
Reversibility
Can the access be modified or restored safely if the decision changes?
Decision Pack
What a Professional Access Review Record Contains
Decision ID
Stable reference for the access review decision.
Example: DEC-1805
Identity
Names the fictional user, service identity, role, or external collaborator.
Example: USR-NB-31
Access / role
Defines the permission or role being reviewed.
Example: ROLE-FIN-READ
Business purpose
States the current reason the access may be needed.
Example: Monthly reconciliation support
Evidence references
Links the decision to specific IAM records.
Example: IAM-1811, IAM-1812
Owner / approver
Names the current accountable fictional roles.
Example: Finance Application Owner
Review freshness
Shows whether approval and access-review evidence are current.
Example: Approval missing; manager note current
Exception
Records whether temporary deviation affects the decision.
Example: None
Decision
Records Retain, Modify, Remove, Escalate, or Evidence Insufficient.
Example: Evidence Insufficient
Rationale
Explains why the evidence supports the chosen outcome.
Example: Possible need exists but current formal approval is missing
Monitoring need
Defines any extra review or evidence needed while the decision remains open.
Example: Track unresolved access review until owner decision
Validation
Defines what confirms the decision was implemented correctly.
Example: Current approval recorded or role removed with no required workflow impact
Scenario Decision Lab
Scenario Decision Lab 1 — Former-Team Access
A fictional user moved to a new team 42 days ago but still holds a read-only reporting role from the previous team. The current job description does not require the old role.
Scenario Decision Lab
Scenario Decision Lab 2 — Emergency Identity With Low Usage
A fictional emergency-access identity has not been used in 211 days, but its quarterly governance review was completed 17 days ago with current owner and approver signoff.
Safe Fictional Lab
Build an Identity Access Review Decision Pack
Review a synthetic identity population and make evidence-backed decisions without confusing unusual access, stale access, and unjustified access.
1
Create at least forty fictional IAM evidence records.
2
Give each evidence record a stable IAM ID.
3
Include at least ten standard-user access records.
4
Include at least six privileged-user records.
5
Include at least six service-identity records.
6
Include at least five external-collaborator records.
7
Include at least three emergency-access records.
8
Include at least six role-definition records.
9
Document current business purpose where known.
10
Document identity type.
11
Document current role or permission.
12
Document resource owner.
13
Document approver.
14
Document last access review date.
15
Document original approval date.
16
Document exception status and expiration.
17
Document monitoring evidence.
18
Document team or job changes.
19
Document project end dates for temporary access.
20
Document service dependencies for service identities.
21
Mark evidence freshness.
22
Mark contradictory owner or approval evidence.
23
Create at least twenty DEC decisions.
24
Give every decision a stable DEC ID.
25
Use Retain outcomes.
26
Use Modify outcomes.
27
Use Remove outcomes.
28
Use Escalate outcomes.
29
Use Evidence Insufficient outcomes.
30
Write an evidence-linked rationale for every decision.
31
Assign a confidence level.
32
Assign a decision owner.
33
Define monitoring needs.
34
Define validation evidence.
35
Identify at least five stale-entitlement cases.
36
Identify at least five temporary-access expiration cases.
37
Identify at least five service-identity governance cases.
38
Identify at least five separation-of-duties cases.
39
Identify at least five cases where usage does not prove justification.
40
Identify at least five cases where unusual access is still legitimate.
41
Write a prioritized remediation queue.
42
Write a one-page leadership summary.
43
Keep all identities, roles, access, approvals, and activity fictional.
Lab boundary
Use fictional identities, roles, applications, approvals, exceptions, sponsors, activity records, and service dependencies only. Do not access, test, create, modify, disable, or remove any real account, role, credential, token, permission, or identity system.
Analyze the Evidence
Evidence Analysis: Emergency Access
The emergency identity has not been used in 211 days.
Low usage is expected for emergency access.
Quarterly review completed 17 days ago.
The owner and approver are current.
The case shows no governance exception or missing review.
What is the strongest decision for BRK-NB-01?
Advanced Challenge
Build a Conflicting-Evidence Access Review
Create a fictional case where an identity appears to have valid access in one record, stale approval in another, active usage in a third, and conflicting ownership in a fourth. Write the decision path without guessing.
1
Identity type
2
Current role
3
Business purpose
4
Technical access state
5
Current usage
6
Owner evidence
7
Approval evidence
8
Review freshness
9
Exception status
10
Conflicting source
11
Decision confidence
12
Interim decision
13
Missing evidence request
14
Escalation owner
15
Final validation
16
Leadership note
The strongest result should demonstrate that “Evidence Insufficient” can be a disciplined professional decision rather than a failure to decide.
Defender Habits
A18.4 Defender Checklist
Skill Check
Seven Questions
Check Your Understanding
A18.4 Mini Quiz: Identity Access Review Case
Choose your answers first. Explanations appear only after submission.
1. What is the strongest evidence that access should be retained?
2. What does frequent access usage prove?
3. What is strongest when a service identity has appropriate technical permissions but its last formal review was fifteen months ago?
4. What should happen when current owner records conflict?
5. Why are exception expiration dates important?
6. What is the best meaning of Evidence Insufficient?
7. What is the purpose of the Identity Access Review Decision Pack?
Portfolio Prompt
Portfolio Build — Identity Access Review Decision Pack
Create the fourth artifact for your A18 Advanced Defensive Casebook: a fictional Identity Access Review Decision Pack. Include identity type, access or role, business purpose, evidence references, current owner, approver, review freshness, exception status, usage context, service dependency where relevant, Retain/Modify/Remove/Escalate/Evidence Insufficient decision, confidence, rationale, monitoring need, validation criteria, remediation priority, and a one-page leadership summary.
Do not confuse frequent usage with current business justification.
Do not assume unusual access is malicious.
Treat service identities as governed identities with owners and review dates.
Use Evidence Insufficient when important authority or purpose evidence is missing.
Make every decision traceable to evidence.
Keep every identity and permission fictional.
Confidence / Readiness Reflection
Are You Ready for A18.5?
A18.5 moves into an Incident Response Tabletop Case. Before continuing, make sure you can make identity decisions from purpose, ownership, approval, freshness, privilege, exceptions, and evidence without jumping from unusual access to unsupported conclusions.
1
I can distinguish unusual access from unjustified access.
2
I can evaluate human, privileged, service, emergency, and external identities differently.
3
I can use Retain, Modify, Remove, Escalate, and Evidence Insufficient appropriately.
4
I can explain why usage alone does not prove access is justified.
5
I can produce an evidence-linked access decision without interacting with a real identity system.
Portfolio Build Guide
How to Make the Access Review Look Professional
Start with purpose
Access only makes sense relative to a current responsibility, service dependency, or approved business need.
Separate state from justification
An active role tells you what exists, not whether it should exist.
Use evidence IDs
Every decision should trace back to the records that support it.
Show review freshness
Old approvals and old access reviews should lower confidence in today's decision.
Allow uncertainty
Evidence Insufficient is appropriate when current ownership or purpose is missing.
Treat service identities seriously
Non-human identities need current owners, purpose, permission scope, monitoring, and review.
Validate the result
A good decision includes evidence that the intended access state was actually achieved.
Connect forward
A18.5 will apply the same evidence discipline to evolving incident-response decisions.
Key Takeaways
What You Should Remember
1.Identity review is about current purpose, scope, ownership, approval, and evidence—not just whether access exists.
2.Frequent use proves activity, not continuing business justification.
3.Low use does not automatically make emergency access unnecessary.
4.Service identities require the same governance discipline as human identities: purpose, owner, scope, review, monitoring, and lifecycle.
5.Stale entitlement often appears after team, project, service, or ownership changes.
6.Overlapping privileged roles may require separation-of-duties review and temporary exception governance.
7.Evidence Insufficient is stronger than guessing when ownership, approval, or business purpose is unresolved.
8.Retain, Modify, Remove, and Escalate decisions should always point back to evidence.
9.Access decisions need validation so reviewers know the intended state was actually achieved.
10.The Identity Access Review Decision Pack becomes the fourth artifact in the A18 Advanced Defensive Casebook.
Lesson Safety Boundary
A18.4 stays fictional, defensive, evidence-based, and non-operational
Do not access, test, create, modify, disable, or remove real user accounts, roles, service identities, credentials, tokens, permissions, or identity systems. This lesson teaches access-review reasoning, governance, ownership, evidence quality, and safe decision documentation using synthetic records only.
Lesson Complete
A18.4 Identity Access Review Case Complete
You now have a defensible access-review model covering human, privileged, service, emergency, and external identities; stale entitlements; approval freshness; ownership; exceptions; least privilege; evidence confidence; and decision validation. Next, A18.5 moves into an Incident Response Tabletop Case.