Access reviews have a bad reputation, and it's earned. Ask most IAM leads what happens during the quarterly certification and you'll hear some version of the same story: a spreadsheet lands in a manager's inbox, the manager scans a list of names and entitlements they don't fully understand, and clicks approve on all of it because the alternative is chasing down thirty people to ask what a role actually does. That's not an access review that catches drift. That's a compliance ritual that happens to produce an audit artifact.
The problem is structural, not a failure of diligence. Access accumulates in one direction. Someone joins a project, gets added to a group, the project ends, and the group membership just sits there. Someone changes teams and inherits new permissions without anyone revisiting the old ones. None of this is malicious, and none of it looks wrong at the moment it happens. It only becomes wrong in aggregate, months later, when nobody remembers why a given person has access to a given system. A review that's just a checklist of "still needs this? yes/no" against last year's baseline has no way to surface that kind of accumulation, because last year's baseline is exactly the thing that's already drifted.
What a review has to actually check
A review that catches drift has to be built around a different question than "does this look fine." It has to ask whether the access still maps to a current, articulable business reason — not whether it matches what was approved before, but whether it would be granted today if requested from scratch. That reframing matters because it shifts the reviewer's job from pattern-matching against history to justifying against present need, and those produce very different answers. It also means the review needs enough context attached to each entitlement that a manager can actually reason about it: what the access is for, who else has it, when it was last used. Without that context, you're back to rubber-stamping, just with better formatting.
Usage data does more work here than approval history ever will. An entitlement nobody has exercised in months is a much stronger drift signal than an entitlement that doesn't match some prior baseline, and it's a signal that doesn't require the reviewer to understand the system's internals — it just requires them to notice that a thing is dormant and ask why it's still granted. Anchoring reviews around that kind of signal, rather than around comparison to a prior list, is what turns the exercise from paperwork into something that actually finds the accounts and groups that quietly outlived their reason for existing.
None of this is unique to human users, either, and treating it as if it were is part of how drift creeps in unnoticed. Service accounts and automated integrations accumulate exactly the same way, usually with less oversight, because nobody's manager gets a certification email for a robot. The same question applies: does this access still map to a current, real need, whether the thing holding it is a person, a service account, or increasingly an AI agent acting on someone's behalf. Access control has never really been about the user category — it's the same discipline whoever, or whatever, is on the other end of the credential, and a review process that only thinks about people is already reviewing half the picture.