Standing Privilege and Access Review Fatigue in a 61-Account Estate

The strongest case is entitlement redesign plus continuous drift detection, because it attacks the root cause and the detection gap at once.

Reasoning:

• The four-month standing admin was not a review failure - the review happens quarterly and took six weeks, so a four-month grant can slip between cycles by design. Automating the review makes a broken process faster; it does not make standing admin visible.
• The trust-policy findings (wildcard-principal trust, missing ExternalId) are symptoms of the same problem: entitlements are created ad hoc and never re-examined. Permission sets with boundaries, deny-guardrails at the organisation level, and time-bound elevation fix the class of finding, not just the instance.
• It also produces the evidence the access review needs: a system-generated list of who holds what, when granted, and when it should expire.

Access review automation is valuable but dependent - reviewing entitlements that are already wrong wastes reviewer attention and explains the 30% blanket approvals. Break-glass hardening is real but affects one credential and one failure mode; it is a two-week task, not the quarter's workstream.

Not without evidence about the dependency, and the evidence here points the other way: it was used twice last year during identity-provider maintenance. That is a live failure mode, not a theoretical one.

If federation is the only path in and the identity provider has an outage, a security control failure becomes an availability incident with no way to administer the estate - an unacceptable trade on a 61-account production platform.

Keep it, but harden it into a genuine break-glass control:

• Credential sealed and retrieved only with two-person approval; retrieval itself pages the on-call security lead.
• The identity holds no standing policy; permissions are attached by an automated, logged procedure.
• Credentials rotated after every use, and use reviewed within 24 hours.
• Tested on a schedule so the test itself is auditable.
• A separate emergency identity path (a second provider or a pre-provisioned emergency role) so a single outage cannot exhaust the options.

The judgement is that "remove all static credentials" is a principle, not an absolute; the exception has to be engineered rather than inherited.

Measure outcomes, not activity. A review that runs faster but approves the same things has not improved.

Useful measures:

• Standing high-privilege entitlements in production accounts, as an absolute count trending down; this is the number that would have caught the four-month admin.
• Mean time to detect entitlement drift (a grant that exceeds policy) - the headline failure was detection, not granting.
• Percentage of roles with a named owner and an expiry. Unowned roles cannot be reviewed meaningfully.
• Just-in-time elevation adoption, paired with the count of standing grants it displaced.
• Reviewer decision quality: proportion of approvals backed by evidence of use, sampled by audit, rather than raw completion percentage.
• Break-glass invocations and time-to-review of each.

Report these monthly to the audit committee alongside the findings count, so the trend line rather than the snapshot carries the argument.