Glossary
Access Review
An access review is a scheduled process of examining existing grants — who has access to what — and confirming each one is still justified, rather than assuming that access, once granted, remains correct indefinitely. It exists specifically because permissions tend to accumulate and rarely get removed on their own once the original task that justified them has ended.
A review that simply asks 'does this person still work here' catches the most obvious case but misses the more common one: someone still employed, still with the same account, whose responsibilities changed months ago while their access didn't. A review scoped only to departures leaves the larger drift problem untouched.