Lesson A13.8
Access review is where identity architecture becomes an ongoing governance process. The question is not whether access was valid when it was first granted; the question is whether it is still appropriate now.
This lesson uses fictional identities, entitlements, owners, review evidence, and governance decisions only. It does not require changing access in any real system.
Lesson Progress
High School Advanced • A13: Identity, Zero Trust, and Access Control • Lesson 8 of 10
Readiness Check
0/4 ready
Professional Hook
A migration administrator may have needed production privilege three months ago. A partner may have needed a support console last month. A reporting analyst may still need dashboards but no longer need sensitive exports. Access review catches the gap between the access an identity currently holds and the access its current responsibility actually requires.
Access governance is lifecycle management for authorization.
Learning Objectives
Explain access review as a governance decision about whether a current identity-to-resource relationship should continue, change, expire, or be removed.
Evaluate access using business purpose, privilege, resource sensitivity, ownership, lifecycle, activity evidence, sponsorship, exceptions, and evidence freshness.
Distinguish Confirm, Reduce, Remove, Reassign, Expire, Review, and Accepted Risk as governance outcomes rather than treating every review as a simple yes/no certification.
Connect access review to workforce lifecycle, external sponsorship, privileged eligibility, workload identity, conditional access, federation, monitoring, and residual-risk decisions.
Build an Access Review Decision Register that becomes the eighth artifact in the A13 Enterprise Identity and Zero-Trust Review.
Review Dimensions
Why does this identity still need this resource or entitlement today?
Evidence
Current job responsibility, application dependency, project need, service ownership, partner support purpose, or approved operating function.
Warning
Historical usefulness is not enough when no current purpose exists.
Has the user's role, team, employer, project, sponsor, workload, or service changed?
Evidence
Joiner/mover/leaver events, project status, sponsor state, service inventory, role-change record, workload retirement evidence.
Warning
Access can become stale even when the entitlement itself has not changed.
Does the identity still need this level of access?
Evidence
Current job duty, privileged eligibility, actual task need, resource owner confirmation, recent use where appropriate.
Warning
A valid need for basic access does not automatically justify elevated privilege.
How significant is the resource or action being reviewed?
Evidence
Application criticality, data classification, management-plane scope, privileged function, external-facing control.
Warning
Higher-impact access deserves stronger review evidence.
Who is accountable for the identity, entitlement, resource, and final decision?
Evidence
Manager, sponsor, resource owner, application owner, privileged-role owner, service owner.
Warning
Unowned access should not be treated as normal.
Does recent use support the stated purpose?
Evidence
Safe authentication, authorization, workload, privileged, or application activity metadata.
Warning
Recent use can support a review but does not by itself prove that access is justified.
Is the access outside the preferred model, and if so, is that deviation still approved?
Evidence
Exception owner, reason, expiration, compensating control, target state, review record.
Warning
Expired exceptions should not become silent permanent access.
Is the review based on current enough information?
Evidence
Current identity state, recent owner confirmation, source health, role metadata, lifecycle event, review date.
Warning
Stale evidence should move the decision to Conditional or Unknown rather than Confirmed.
Governance Outcomes
Current evidence supports keeping the access unchanged.
Example: An active counselor still needs the counselor role for current student-support work.
Some access remains justified, but the current scope or privilege is broader than needed.
Example: A reporting analyst keeps dashboard access but loses a sensitive export entitlement no longer required.
No current approved purpose remains.
Example: A former project administrator loses migration-admin eligibility after the project closes.
Ownership or sponsorship must move to a new accountable person or team before access can continue.
Example: A service changes teams and the workload identity needs a new service owner.
Time-bounded access reaches its planned end state.
Example: A partner support identity expires when the support agreement or project window ends.
Available evidence is not sufficient for a confident continuation or removal decision.
Example: The resource owner is unknown and monitoring evidence is partial.
A known access weakness is explicitly approved for a bounded period by an authorized risk owner.
Example: A legacy service remains temporarily active under a documented exception while replacement work is underway.
Review Triggers
Examples: Quarterly privileged-access review, semiannual application review, annual low-risk entitlement review.
Why it matters: Provides recurring confirmation even when no obvious change event occurs.
Examples: Counselor moves to operations, platform engineer changes teams, manager responsibility shifts.
Why it matters: Previously appropriate role memberships may no longer match current duties.
Examples: Joiner, mover, leaver, contract end, leave status, rehire.
Why it matters: Identity lifecycle directly affects whether access should exist.
Examples: Migration starts, project milestone ends, temporary support closes, pilot is retired.
Why it matters: Project-bound roles and exceptions should end with the project unless re-approved.
Examples: Partner sponsor leaves, guest sponsor changes, business owner no longer supports access.
Why it matters: External access should remain tied to a current internal owner.
Examples: Application becomes more sensitive, data classification changes, service ownership moves, feature is retired.
Why it matters: Authorization appropriate for the old resource state may no longer be appropriate.
Examples: New admin function, elevated role, JIT eligibility, emergency-access assignment.
Why it matters: Higher impact should trigger stronger review.
Examples: Unused high privilege, environment mismatch, stale attribute, unexpected authorization decision.
Why it matters: Evidence can reveal that the design no longer matches intended access.
Governance Principles
An entitlement name like 'Analyst' or 'Admin' is not enough; reviewers need to know principal, resource, action scope, purpose, and lifecycle.
Review: Can another person explain exactly what the access allows?
A manager may understand the user, while a resource owner understands the application or data impact.
Review: Are the right decision owners participating?
An entitlement can be frequently used and still be overbroad or inappropriate.
Review: Does use match the approved business purpose?
Long-unused access may indicate stale need, but absence of use should be interpreted with business context.
Review: Is the access rarely used because it is emergency-only, or because it is obsolete?
Administrative capability deserves more frequent and more evidence-rich review than routine low-impact access.
Review: Is privileged eligibility still tied to a current responsibility?
Partners and guests should not remain active without a current internal owner and business purpose.
Review: Who sponsors the identity today and when does it expire?
A temporary risk acceptance should not turn into a permanent access model by default.
Review: What target state will close the exception?
When ownership, purpose, evidence, or lifecycle is unresolved, the review should say so.
Review: Is Unknown being hidden behind a Confirmed status?
Lifecycle Governance
What baseline access is required for the new responsibility?
Decision focus: Minimum initial role, correct environment, sponsor/manager, resource approval, no inherited unnecessary access.
Which old access should be removed as new responsibilities are added?
Decision focus: Privilege reduction, old-team roles, project entitlements, resource ownership, conflicting duties.
Which workforce, privileged, federation, partner, workload, and local access relationships must close?
Decision focus: Revocation timing, dependent ownership transfer, emergency identities, active sessions, shared resources.
Which temporary roles, exceptions, and privileged eligibility should expire?
Decision focus: Project-bound access, migration roles, temporary support, partner permissions, closure evidence.
Which workload identities, service accounts, roles, policies, and monitoring sources should retire with the service?
Decision focus: Non-human identity cleanup, local credentials, role removal, ownership transfer, archive evidence.
Should external access continue when the original sponsor is no longer accountable?
Decision focus: Reassign sponsorship, reduce access, expire identity, confirm current business need.
Vocabulary
A structured decision about whether an existing identity-to-resource relationship should continue, change, expire, or be removed.
A formal confirmation that reviewed access remains appropriate based on current evidence.
A role, permission, group membership, resource access, privileged eligibility, or other authorization granted to an identity.
Identity lifecycle events describing entry into an organization, change of responsibility, and departure.
A recurring review that confirms whether existing access should still remain.
The person or team accountable for deciding appropriate access to an application, service, data resource, or privileged function.
The internal owner accountable for an external or guest identity's continued business need.
Risk that remains after controls, restrictions, compensating measures, or remediation have been applied.
An explicit authorized decision to tolerate a known residual risk for a defined period and purpose.
The action taken after review to reduce, remove, expire, reassign, or otherwise correct access.
How current the identity, ownership, activity, lifecycle, and policy evidence is relative to the review decision.
The accountable person or team responsible for the continued validity of a specific access relationship.
Fictional Access Review Register
Entitlement
Counselor Role
Purpose
Current student-support workflow
Privilege
Standard application access
Lifecycle
Current counselor role
Owner
Student Services Application Owner
Activity
Recent role-appropriate use
Evidence
Current identity + role + authorization + owner confirmation
Exception
None
Next action
Review next quarter or on role change
Governance concern
Access should change immediately if counselor responsibility ends.
Entitlement
Reporting Analyst + Sensitive Export
Purpose
Dashboard reporting remains current; export need ended
Privilege
Mixed standard + sensitive capability
Lifecycle
Role current
Owner
Analytics Product Owner
Activity
Dashboard active; sensitive export unused for 120 days
Evidence
Current role + activity + owner confirmation
Exception
None
Next action
Remove Sensitive Export; retain standard reporting
Governance concern
Keeping all access because some access is still needed would be overbroad.
Entitlement
Migration Administrator Eligible
Purpose
Historical project; no current need
Privilege
Privileged eligibility
Lifecycle
Project closed
Owner
Migration Project Owner
Activity
No recent activation
Evidence
Current project closure + eligibility feed
Exception
None
Next action
Remove privileged eligibility and record closure
Governance concern
Unused privilege still remains available until eligibility is removed.
Entitlement
External Integration Support
Purpose
Current partner support
Privilege
Narrow external support access
Lifecycle
Review due in 30 days
Owner
Integration Owner / Sponsor
Activity
Recent support activity
Evidence
Current sponsor + federation + app authorization
Exception
None
Next action
Sponsor must confirm continuation before expiration
Governance concern
Current activity does not replace the scheduled sponsor decision.
Entitlement
Application Workload Access
Purpose
Current production application dependency
Privilege
Application-specific data operations
Lifecycle
Service active
Owner
Application Team + Data Platform
Activity
Current workload access
Evidence
Workload identity + deployment + database authorization logs
Exception
None
Next action
Review on application/dependency change
Governance concern
Service retirement must include workload-identity retirement.
Entitlement
Historical Report Write Access
Purpose
Historical job; current need uncertain
Privilege
Legacy service permission
Lifecycle
No current review
Owner
Unknown
Activity
Intermittent
Evidence
Partial logs + stale entitlement metadata
Exception
No valid current exception
Next action
Resolve owner and business need; remove or formally govern
Governance concern
Activity alone does not justify unowned legacy access.
Entitlement
Emergency Admin Eligible
Purpose
Rare critical recovery
Privilege
Emergency privileged eligibility
Lifecycle
Eligibility current
Owner
Resilience + Security
Activity
One prior emergency use
Evidence
Activation/audit current; post-use review incomplete
Exception
Emergency session review condition
Next action
Complete post-use review before full certification
Governance concern
Emergency access may remain eligible, but unresolved prior use must stay visible.
Fake Dashboard
Fictional certification, reduction, removal, and open governance decisions
Access relationships reviewed
7
Workforce, reporting, privileged, partner, workload, legacy, and emergency access
Confirm unchanged
2
Counselor and production workload access remain justified
Reduce / Remove
2
Sensitive export is reduced and obsolete migration privilege is removed
Open review conditions
3
Partner renewal, legacy ownership, and emergency post-review require closure
Fake SOC Alert
Source: Fictional Access Governance Review • Time: 08:48
Use vs. Need
A counselor regularly using role-appropriate application functions is useful evidence when current job responsibility and resource ownership also support the access.
A user may actively use a capability that is convenient but no longer required. Access review asks whether use is authorized by current purpose, not merely whether use occurs.
Low use also needs context.
Emergency recovery access may be rarely used and still be legitimate. Long-unused ordinary or privileged access, however, may indicate stale need. Governance uses purpose and lifecycle to interpret activity correctly.
Fake Log Panel
[08:01] REV-01 counselor role=CURRENT purpose=CURRENT decision=CONFIRM state=CONFIRMED [08:24] REV-02 reporting sensitive_export=UNUSED_120D decision=REDUCE state=CONFIRMED [08:48] REV-03 migration-admin project=CLOSED eligibility=ACTIVE decision=REMOVE state=BLOCKED [09:13] REV-04 partner sponsor=CURRENT review_due=30d decision=REVIEW state=CONDITIONAL [09:37] REV-05 portal-workload service=ACTIVE dependency=CURRENT decision=CONFIRM state=CONFIRMED [10:01] REV-06 legacy-report owner=UNKNOWN evidence=PARTIAL decision=UNKNOWN state=BLOCKED [10:26] REV-07 emergency-admin post_review=PARTIAL decision=REVIEW state=CONDITIONAL
Training note: this is fake data for defensive analysis practice only.
Analyze the Evidence
Governance Anti-Patterns
Why it fails: Reviewers approve large access lists without examining purpose, scope, privilege, or lifecycle.
Better approach: Require enough context to make a real decision for each material access relationship.
Why it fails: Labels such as Analyst or Admin hide what the role actually permits.
Better approach: Show resource, action scope, privilege, environment, and owner.
Why it fails: Frequently used access is automatically kept even when the scope is broader than the business need.
Better approach: Treat activity as supporting evidence, not proof of authorization need.
Why it fails: Rare emergency or seasonal access can be legitimate even when it is seldom used.
Better approach: Interpret low use together with purpose, lifecycle, and resource impact.
Why it fails: The manager may understand the employee but not the technical impact of the admin role.
Better approach: Include privileged-role or resource owners in higher-impact decisions.
Why it fails: Partner access remains active after the internal business relationship changes.
Better approach: Require current sponsorship and expiration or recertification.
Why it fails: Temporary risk becomes permanent because every review simply extends the same exception.
Better approach: Require remediation target, closure owner, and bounded expiration.
Why it fails: Nobody can explain who is accountable for the entitlement or resource.
Better approach: Move the relationship to Unknown/Blocked until ownership is resolved.
Scenario Decision Lab
A reporting analyst still needs the dashboard role, but the resource owner confirms that a separate sensitive-export entitlement is no longer required.
Scenario Decision Lab
A legacy reporting account still performs occasional production work. The current owner is Unknown, evidence is partial, and no valid current exception exists.
Safe Fictional Lab
Use fictional identities, entitlements, resources, owners, lifecycle records, and synthetic activity evidence only. Do not modify any real access.
Create at least fifteen fictional access-review records.
Give every record a stable REV ID.
Record principal and principal type.
Record resource/application.
Record entitlement or privileged eligibility.
State current business or technical purpose.
Record privilege level.
Record lifecycle state.
Record identity owner, manager, sponsor, or service owner.
Record resource/entitlement owner.
Record recent activity evidence where appropriate.
Record evidence freshness.
Record exception or risk-acceptance status.
Choose Confirm, Reduce, Remove, Reassign, Expire, Review, or Accepted Risk.
Record the reason for the decision.
Record remediation or next action.
Record closure owner.
Record review/change trigger.
Include at least three workforce examples.
Include at least three privileged examples.
Include at least two external/partner examples.
Include at least two workload identities.
Include at least two temporary/project examples.
Include at least one unowned legacy entitlement and keep it Blocked.
Include at least one Accepted Risk record with owner, expiration, and target state.
Lab boundary
This is a fictional governance exercise. Do not inspect private access lists, remove real users, change group membership, alter roles, or modify any live identity or authorization system.
Analyze the Evidence
Advanced Challenge
A fictional organization has workforce roles, partner guests, privileged eligibility, workloads, temporary project access, emergency identities, and several legacy exceptions. Design a review board that can make consistent decisions without rubber-stamping everything.
Identity lifecycle evidence
Business purpose evidence
Resource sensitivity
Privilege level
Manager/sponsor input
Resource-owner input
Workload/service ownership
Activity evidence
Source health
Exception state
Risk owner
Confirm/Reduce/Remove logic
Reassignment logic
Expiration logic
Remediation ownership
Closure evidence
A mature review board should preserve legitimate access, reduce unnecessary scope, remove stale relationships, escalate uncertainty, and document who owns each follow-up action.
Defender Habits
Skill Check
Check Your Understanding
Choose your answers first. Explanations appear only after submission.
Portfolio Prompt
Create the eighth artifact for your A13 Enterprise Identity and Zero-Trust Review: a fictional Access Review Decision Register with at least fifteen records. Include REV ID, principal, principal type, resource, entitlement, purpose, privilege, lifecycle, identity owner/manager/sponsor/service owner, resource owner, activity evidence, evidence freshness, exception/risk state, decision, rationale, remediation, closure owner, status, and next review/change trigger.
Confidence / Readiness Reflection
A13.9 moves into Balancing Security and Usability. Before continuing, make sure you can explain how an access review can preserve necessary work while reducing unnecessary friction and privilege.
I can explain access review as a lifecycle governance decision.
I can distinguish Confirm, Reduce, Remove, Expire, and Review outcomes.
I can explain why activity does not automatically justify access.
I can explain how privileged, external, and workload access need different evidence.
I can explain how exceptions and residual risk should remain visible.
Portfolio Build Guide
Do not stop at job title. Record the actual resource, role, privilege, or workload permission under review.
Make the current reason for access and the event that should change or end it visible.
Manager, sponsor, service owner, privileged-role owner, and resource owner may have different responsibilities.
Current, Partial, Stale, Missing, and Unknown evidence should affect review confidence.
Use Confirm, Reduce, Remove, Reassign, Expire, Review, or Accepted Risk rather than vague notes.
Every reduction, removal, reassignment, or exception should have an owner and closure state.
Do not certify an account simply because removing it might be inconvenient.
A13.9 will evaluate how strong controls can remain usable, understandable, and proportionate.
Key Takeaways
Lesson Safety Boundary
Do not remove real users, alter permissions, change roles, inspect private identity exports, or modify live access-control systems. All identities, entitlements, review evidence, and governance decisions in this lesson are fictional and defensive.
Lesson Complete
You now have an access-governance model built around current purpose, lifecycle, privilege, ownership, activity evidence, sponsorship, exceptions, residual risk, remediation, and closure. Next, A13.9 focuses on Balancing Security and Usability.