Guide
GuidesContinuous access reviews
Continuous access reviews
The access review is the audit task everyone dreads: a spreadsheet of who can touch what, exported, emailed to managers, and rubber-stamped. It is stale before it is signed. Here is what it is supposed to catch and how to run it so the answer stays current.
~3 min read
What a review is supposed to catch
A real access review is looking for three things. Terminated-active accounts: people who left but still have a live login somewhere. Separation-of-duties conflicts: one person holding two entitlements that should never sit together, like raising and approving the same payment. And stale or over-broad access: the engineer who got production rights for a one-week project two years ago. Across every SOX-sensitive system, these are the findings an auditor expects you to have found first.
Why the spreadsheet version fails
The manual review is point-in-time. You pull entitlements into a sheet, but the export is out of date the moment it lands, and the reviewer reading it has no easy way to tell a risky grant from a routine one. So managers approve the whole list to clear their inbox. The process produces a signed artifact and almost no security. Worse, finding a problem and fixing it are separate jobs: the review flags the stale account, and revoking it is a ticket that may or may not get worked.
Continuous, with the fix attached
Paragon’s Access Review module runs the same checks on demand instead of once a quarter. It scores the risk, lists the violations, the terminated-active accounts, the SoD conflicts, the stale entitlements, ranked by severity, and generates the remediation plan alongside them: which accounts to deprovision, which entitlements to pull, in what order. Because it is a run and not a meeting, you can do it before a board review, after a reorg, or the week a deal closes, and re-run it afterward to confirm the violations actually dropped.
Evidence the auditor will accept
Every run is logged per tenant with its timestamps and inputs, so the record of how access was evaluated, and what was remediated, is the evidence. There is no separate screenshotting exercise before the audit; the trail is a byproduct of running the review. It is the same pattern across Paragon: the assessment and the remediation come out together, logged. See the wider picture in IT governance, run by agents, or the Paragon dashboard to see the Access Review module render a real assessment.
Related guides
Keep reading
Governance
IT governance, run by agents
How Paragon turns governance from a dashboard of problems into an assess, generate, remediate loop across twelve modules.
Identity
Okta Terraform automation
Managing Okta as code: what belongs in Terraform, the parts that bite (event hooks, drift, lifecycle), and how to get it right.
Run a review on your stack
Tell us the systems in scope and we will run an access review against them live.
Subscribe
Get new guides when they drop. One email when there is something to read; never spam.