Recertifying Extra Access for Movers Using Access Panel

When an employee changes roles, organizations need to ensure that their access aligns with their new responsibilities. Access Panel supports this process with built-in features for identifying and reviewing access that falls outside of role-based entitlements.

Identifying Extra Access During Role Changes

In Identity and Access Management (IAM), users typically receive "birthright" access—permissions granted automatically based on their department, job title, or location. These are often defined in a role-based access control (RBAC) model. However, employees may acquire additional permissions over time that are not part of their standard role. When an employee moves to a new position, it’s critical to identify and review this extra access to ensure it’s still appropriate.

Access Panel enables this by automatically comparing current access with the entitlements defined for the new role. It flags any access that is not considered part of the employee's new role-based or birthright entitlements. These flagged permissions are then eligible for recertification through an attestation campaign or reviewed manually.

How Access Panel Supports Recertification

Access Panel uses policies and automation to streamline access governance during the mover process:

• Criteria Policies define which resources are considered in or out of scope based on the user’s new role.

• Attestation Campaigns can be triggered for any access that falls outside defined entitlements, allowing managers or system owners to approve or revoke extra access.

• Just-in-Time (JIT) Access and Request Policies help control how additional access is requested or maintained moving forward.

Recertification ensures that only necessary and authorized access persists after a role change, supporting least privilege and compliance goals.