Loading patterns…
Periodically review who has access to what, confirm it's still needed, and revoke what isn't. Kills the slow-drip accumulation of stale permissions that turn into audit findings.
Rendering diagram…
Use access review whenever access matters and people change roles or leave:
If access never changes and no one ever leaves your company, you're lucky and you don't need this pattern.
On a cadence (monthly for critical systems, quarterly for most, annually for long-tail), a process enumerates every access grant and routes it to a reviewer — typically the grantee's manager, the system owner, or a data steward. The reviewer confirms the grant is still needed or revokes it.
Grants not confirmed by the deadline are auto-revoked. "No response" must not mean "keep" — that's how stale access accumulates.
Celebrate revocations. A review that revokes nothing is a review the reviewers didn't do. Report on "access removed this quarter" as a security metric.
You can't review what you can't see. Ingest grants from every system (IAM, databases, SaaS tools, file shares) into a single table. This alone often reveals surprises.
System owner, grantee's manager, data steward, or a mix. Encode the rule per system. When an edge case surfaces ("this group has no owner"), fix it in the inventory, not per-review.
Each reviewer should see only their scope, with enough context to decide: user, resource, what it grants, when last used, who originally approved. "Last-used" is the single most useful signal.
Non-response is revocation. Communicate this explicitly at every reminder. The first time you auto-revoke someone important, expect noise; stand firm, re-grant if appropriate, and the culture shifts.
Confirmed revocations must actually remove access. Integrate with your IAM, HR, and tool APIs so a "revoke" click propagates everywhere within minutes. Manual tickets to remove access is how revocations get forgotten.
Record every significant action to an append-only log that can be inspected but not altered. Essential for compliance, incident response, and answering 'who changed this and when?'
Externalize complex branching logic — pricing tiers, eligibility rules, routing decisions — into a readable table that business users can maintain without a developer in the loop.
Enforce mandatory review and documentation at specific points in a process to meet regulatory, legal, or internal policy requirements. Non-negotiable gates that cannot be bypassed.