When Nobody Knows What the Access Does

A manager opens an access review. It lists their team and every entitlement each person holds, by the name the system uses. They are supposed to decide whether each one is still needed. But they cannot tell what most of these entitlements actually let a person do.

So they ask the entitlement owner. The owner does not know either.

This gets harder the moment you look beyond the audit list, which was the subject of Series 3 Post 5, Tens of Thousands of Entitlements and the Few Anyone Reviewed. Everything you find has to be reviewed by someone.

This is one of the hardest problems in identity, and one of the most common. An entitlement was created years ago for a reason nobody wrote down. It has been granted, copied, and approved so many times that it looks legitimate. But nobody can say what it does, and you cannot make a real decision about access nobody can explain.

So the reviewer approves, because removing something you do not understand feels riskier than keeping it. The campaign closes on time. Nothing changes.

AI can help here. It can read what an entitlement touches and how people actually use it, and give you a good first guess. But a guess is not an answer until someone who owns it confirms it.

From there, there are a few honest ways out, and none of them are quick.

Start with the entitlements nobody has used in months. They are the safest to remove and the quickest to learn from.

Sometimes you remove the entitlement, with the people who hold it forewarned and a way to put it back, and see what they can no longer do. If something breaks, you learn what it was for.

Sometimes you build a new, clean entitlement that grants only what you know is needed, move people onto it, and retire the old one.

And sometimes you accept the risk for now, write it down with an owner, and make a plan to figure it out.

Those choices belong to the person leading identity. Reviewers and owners can only work with what they know. A leader decides which path each unexplained entitlement takes, makes sure someone owns the answer, and stops treating an approval as proof that anyone understood what was approved.

Give reviewers an answer besides approve or revoke. "I don't know what this is" should be a real choice that sends the item to the owner or the identity team. And show reviewers a plain-language description instead of the system name.

An entitlement nobody can explain is still granting access every day. I would rather find out what it does than keep approving it.

Related

• Series 1 Post 8: LinkedIn post
• Series 3 Post 5, Tens of Thousands of Entitlements and the Few Anyone Reviewed