Quarterly access review. A spreadsheet of every user and every entitlement goes to each manager. They scan a list of role names, recognise none of them, approve everything, and the control is marked complete.
The evidence is real. The review did not happen.
Why it fails
The reviewer is given data they cannot evaluate. prod_db_readonly means nothing to a sales manager. With forty rows and no basis for judgement, approving all is the only rational action.
The fix is not more training. It is asking a question they can actually answer.
Show the exceptions, not the inventory
Most access is unremarkable and reviewing it is noise. Precompute what is unusual and review only that:
- Permissions nobody else in the same role has
- Access not used in ninety days
- Anything granted outside the normal request process
- Accumulated entitlements after a role change — the classic
- Privileged access granted temporarily and never revoked
That turns forty rows into three, each with a reason attached. Three exceptions with context get genuinely considered.
Give the reviewer the evidence
Every line should carry what the permission allows in plain language, when it was granted and by whom, and when it was last used. “Can read customer payment details. Granted 14 months ago for a migration. Last used 11 months ago.” answers itself.
Revocation must be the easy path
If approving is one click and revoking means filing a ticket, you have designed the outcome. Revocation should be a click that queues the change, with the reviewer’s decision recorded as the authorisation.
Record the decision, not the completion
The evidence worth keeping is per-entitlement: what was presented, who decided, what they decided, and when it took effect. “Manager X completed the Q2 review” is a completion record. A row per decision is a review.
Watch the approval rate
If a reviewer approves 100% every quarter, the review is not functioning — and that is measurable without asking anyone. A healthy exception-based process revokes something most quarters. One that never revokes anything is a signature collection exercise, and it will hold up until the breach report asks who approved the access.