Entitlement reviews sound like paperwork until you're the one running them against a large, HIPAA-regulated healthcare system. Then you notice something fast: the risky access almost never looks risky on paper. It looks routine.
Least privilege is one of those principles that's easy to nod along to and genuinely hard to operationalize. In theory, everyone has exactly the access their role requires, nothing more. In practice, access accumulates. Someone covers for a coworker for two weeks and never loses the temporary permission. A role gets cloned from a similar one because it's faster than building from scratch, and it carries over entitlements nobody actually needs. None of it looks like a violation in the moment. It just looks like someone being helpful, or someone being efficient.
The access nobody flags until it's too late
The pattern I've come to trust the most isn't "does this person have access to something sensitive," it's "does this person still need the access they were given for a reason that no longer exists." That second question is where most of the real risk hides. A role change six months ago. A project that wrapped up. A system migration where the old permissions were never cleaned up because the new ones were added on top instead of replacing them.
Access rarely gets granted maliciously. It gets granted reasonably, once, and then never revisited.
Why entitlement reviews aren't just a compliance checkbox
It's tempting to treat access certification campaigns as something you run because an auditor requires it, then forget about until the next cycle. That framing misses what the review actually catches: it's the one recurring moment where someone is forced to ask "does this still make sense" about access that would otherwise just keep existing by default.
- Stale access is the default outcome of normal operations, not an exception that needs a special explanation
- The riskiest entitlements are usually the ones nobody remembers granting, not the ones flagged as sensitive from the start
- A review process only works if someone is actually accountable for the "yes, this is still correct" answer, not just clicking through a list
What minimum-necessary actually means in practice
HIPAA's minimum-necessary standard sounds abstract until you're applying it to a real role in a real clinical environment, where over-restricting access has its own cost. Lock someone out of something they legitimately need, and you've traded a security problem for an operational one, sometimes at a moment where speed of access actually matters for patient care. The job isn't "restrict everything," it's making a defensible, specific judgment call about what a role actually needs, and being able to explain that judgment to an auditor later.
That's the part I don't think shows up clearly enough in how people talk about least privilege. It's not a setting you configure once. It's a discipline you have to keep applying, on a schedule, against access that will drift by default if nobody's watching it.