Access review, done against what people actually use
An identity-aware access review compares the access people and service accounts have been granted with the access they actually use. Laying the two side by side separates three states that most tools blur together: access granted and used (fine), access granted but never used (dormant privilege, the raw material of lateral movement), and access used without any grant behind it (shadow access, which should not exist at all).
Ask any team how they do access reviews and you will usually hear about a quarterly spreadsheet. A manager gets a list of their reports and the systems each one can reach, ticks the boxes, and sends it back. Everyone involved knows two things: that nobody really reads the list, and that it says nothing about whether any of that access is used.
That second gap is the one that matters. Attackers do not need new access; they need existing access that nobody is watching. An account that can reach a production database and has not touched it in 90 days is exactly what a credential thief is hoping to find.
Configured is not the same as used
Your identity provider knows what is granted: group memberships, roles, direct assignments, service-account scopes. Your logs know what is used: who authenticated to what, when, and how often. Almost no organization puts the two together, which is why reviews feel like paperwork — they only ever see half the picture.
Put them together and the review changes character. Instead of asking a manager “should Priya have this?”, you can tell them “Priya has admin on the ERP database and hasn’t used it since March. Keep or remove?” That is a question someone can answer in two seconds, and answer well.
Three states, three different problems
Once configured and observed access are modeled as independent facts, every principal-to-asset pair falls into one of three states:
- Granted and used — expected. Review the level, not the existence.
- Granted and dormant — a privilege that only an attacker will ever exercise. The classic least-privilege clean-up, now with evidence.
- Used without a grant — shadow access. Someone is reaching an asset through a path your identity provider does not know about: a shared credential, a local account, a misconfigured trust. This is the finding worth paging someone for.
Why a graph, not a table
Six hundred people, forty assets and a few thousand grants will not fit in a spreadsheet anyone reads. The same data as a graph — people on one ring grouped by team, assets on another grouped by environment, grants bundled between them — reads in a glance. Which asset is reachable by half the company. Which team holds most of the privileged grants. Where the red edges are.
A graph also answers the questions that matter during an incident: if this account is compromised, what can it reach right now? If this server is compromised, whose credentials just became interesting?
What good looks like
A healthy access posture is not zero dormant grants — some standby access is legitimate. It is a known, shrinking number of dormant privileged grants, zero unexplained shadow access, and a review process that produces decisions instead of ticks. The instrument that makes this possible is the comparison itself: configured, observed, side by side, continuously.
How Onek.ai does access review
Onek.ai builds the identity graph from your HR system and identity provider, then lays observed use on top of it from auth logs, ingested telemetry and its own audit trail.
Available today
- Workforce import from Workday and BambooHR, reconciled with Active Directory; employees, service accounts, departments and managers.
- A principal-to-asset access graph with configured and observed access held as independent facts — used, dormant and shadow are never conflated.
- A radial review view: people and service accounts by function, assets by domain, grants bundled between them, with per-person and per-asset drill-down (level, grant source, last use).
- Findings for shadow access, dormant privilege, privileged concentration and over-exposed assets.
- Per-asset access inventory (“who can reach this?”) and per-user inventory (“what can they reach?”), by level and source.
On the roadmap
- One-click revocation requests routed through the same approval-gated remediation layer as configuration changes.
Frequently asked questions
- What is shadow access?
- Access that is being used without a matching grant in your identity provider — for example through a shared credential, a local account on the device, or a trust relationship nobody documented. It is the most important finding an access review can produce, because it is invisible to policy-based review.
- What is dormant privilege?
- A grant that exists but has not been exercised in a long time — commonly 60 or 90 days. Dormant privileged grants (admin, owner) are the highest-value clean-up in most environments: they offer attackers lateral movement while providing the business nothing.
- Does this replace my identity governance (IGA) tool?
- No. IGA tools manage the lifecycle of grants — joiner, mover, leaver, certification campaigns. Onek.ai adds the evidence layer those campaigns are missing: what is actually used, and what is used without a grant. The two work well together.
Related platform capabilities
Learn the concepts