3.4.2. Access Reviews
💡 First Principle: Access reviews periodically ask "does this person still need this access?" and require an explicit answer — from the user, their manager, or a resource owner — rather than letting a grant persist indefinitely by default, which is exactly how stale, unnecessary access accumulates over time in most organizations.
Recurring access reviews (say, quarterly) catch the common real-world case: someone changed teams six months ago, and nobody remembered to remove their old team's resource access. Without a review process, that stale access sits there indefinitely as unnecessary risk — an unnecessary door left unlocked.
⚠️ Exam Trap: Access reviews verify existing access is still appropriate — they are not the mechanism that grants access in the first place (that's entitlement management or direct role assignment).
Reflection Question: Why might an organization schedule access reviews to recur automatically every quarter, rather than relying on individual managers to remember to revoke access when someone changes roles?
