Access Certification
A periodic review where a manager or resource owner confirms that a person's current access is still needed — the core mechanism of identity governance.
aka: recertification
Certification only works if the reviewer actually looks — a campaign that gets rubber-stamped as “approve all” runs the process without delivering its purpose. It’s the primary tool for catching privilege creep and SoD violations that automated controls didn’t block at grant time.