Access Review
An access review is a systematic process of validating that existing access permissions are still appropriate for each user. Reviewers (typically managers or app owners) evaluate whether each person still needs the access they have and revoke permissions that are no longer justified.
Why It Matters
Access reviews are a core IGA workflow and a requirement in most compliance frameworks (SOC 2, ISO 27001, HIPAA). They are the primary mechanism for catching access creep: the gradual accumulation of permissions over time as employees change roles, join projects, and acquire access that is never revoked.
For AI agents, traditional access reviews are insufficient. Agents do not accumulate permissions over time in the way humans do (at least in a well-governed system). Their permissions are session-scoped and task-specific. What needs to be reviewed is the policy that governs the agent, not the agent's current permissions.
Agent-specific access reviews evaluate whether policies are appropriately calibrated: are the right actions auto-approved, are the right actions escalated, and are the audit logs showing any patterns that suggest the policy should be tightened or relaxed.