Nobody gets into security because they dream about access certification campaigns. Threat hunting sounds exciting. Incident response sounds exciting. Reviewing a spreadsheet of who has access to what and asking "does this still make sense" sounds like the least interesting task on anyone's list. That's exactly why it's the part that quietly matters most.
Almost every breach post-mortem you'll ever read has the same shape underneath the specific exploit: someone had access they shouldn't have had, and nobody caught it in time. Not because the tooling failed, but because the review process that was supposed to catch it either didn't run, ran too infrequently, or ran and got rubber-stamped without anyone actually checking.
Three ways access quietly goes wrong
Working around SailPoint and Entra ID daily, the same three patterns keep showing up, and none of them look dramatic when you catch them:
- Excess access — a system or group that doesn't match what the person's role actually calls for. Usually explainable, rarely intentional, still a real exposure
- Stale access — entitlements nobody's revisited in months. The default outcome of normal operations, not an edge case
- Privilege violations — elevated access granted to a role that was never supposed to have it, often inherited from a template or a "just this once" exception that never got walked back
None of these look like a violation in the moment. They look like someone being helpful, or someone being efficient. That's what makes them dangerous.
Why I built a tool instead of just writing about it
I could explain this pattern in a blog post and stop there, but I wanted to actually build the thing that catches it, not just describe it. So I built an IAM Access Review Bot: a Python tool that takes a role baseline (what access each role should have) and a real access export (what access people actually have), runs the comparison, and flags exactly these three categories, each risk-scored with a recommended action, compiled into a certification-ready report.
It's a small tool. It doesn't need to be complicated to prove the point. The logic underneath it is the same logic underneath every real entitlement review campaign: compare reality against baseline, flag the gap, force a human decision instead of letting drift happen by default.
The part that doesn't get automated
Building this didn't make me think access review is easy to automate away. It made the opposite point clearer: the flagging logic is straightforward, but the judgment call of "is this exception actually fine, or does it need to be revoked" is still a human decision, made against a specific regulatory and organizational context. The tool's job is to make sure that decision actually gets forced, on a schedule, instead of quietly never happening.
That's the whole argument, really. Access review is boring because it's repetitive, not because it's unimportant. The breaches that make headlines almost never come from a sophisticated zero-day. They come from access that should have been revoked six months earlier and wasn't, because nobody built the process, or the tooling, to force that question to actually get asked.