阅读中文版本

Access Certification Workflow

Run periodic access reviews where owners confirm or revoke permissions so stale entitlements do not accumulate.

Overview

Periodically certify access so unused or excessive entitlements are revoked.

This workflow is reusable across teams and environments; adapt the commands to your tooling while keeping the sequence and checkpoints intact.

Environment and prerequisites

• An identity governance system
• Resource owners
• Access usage data

Procedure

1. Generate the certification campaign

List users and their entitlements grouped by resource owner.

Expected state: Each owner sees the access they are accountable for.

2. Review with usage context

Show owners last-used information so decisions are evidence-based.

Expected state: Unused access stands out for revocation.

3. Confirm or revoke

Owners certify needed access and revoke the rest with a reason.

Expected state: Every entitlement is explicitly affirmed or removed.

4. Verify revocation completed

Confirm revoked access is actually removed in the target system.

Expected state: Revocations are effective, not just recorded.

# list entitlements unused for 90 days
SELECT user, entitlement FROM access_usage WHERE last_used < now() - interval '90 days';

Verification

Confirm campaign completion, that revoked entitlements were removed, and unused-access percentage trends down.

Decision points

Review all access or privileged only?

• Prioritize privileged and sensitive
• Review everything each cycle

Recommendation: Prioritize privileged and sensitive access; sample the rest.

Auto-revoke on no response?

• Revoke on non-response for privileged
• Extend deadlines

Recommendation: Revoke privileged access on non-response to avoid silent accumulation.

Common failures

• Rubber-stamping certifications keeps stale access.
• No usage data means decisions are guesses.
• Recorded revocations that are not applied leave real access.