Access Reviews
Access reviews turn CIEM output into an attestation workflow. Each flagged identity gets a state, a reviewer and an outcome — so a review is a tracked decision rather than a spreadsheet emailed once a quarter.
Review states
| State | Meaning |
|---|---|
| Pending | Awaiting a reviewer's decision |
| Needs remediation | Reviewed, and something must change |
| Reviewed | Decision recorded, no change needed |
| Deferred | Explicitly postponed, with the deferral recorded |
Deferred is a first-class state on purpose. A review process without one produces reviewers who mark things "reviewed" to clear the queue, which is worse than an honest backlog.
The finding stays attached
Each identity under review carries the CIEM evidence that flagged it — its permission gap, granted and used counts, and high-risk unused actions. A reviewer who cannot see why an identity was flagged approves it, every time.
What reviews cover
Reviews open automatically for AWS identities whose CIEM risk score reaches the high tier. Decisions are written to an audit trail, expire after a set period, and return to pending if a reviewed or deferred identity is flagged again. The full workflow is in Right-sizing workflow.
Auditor evidence
Because each review carries its state, its reviewer and its timestamp, the review history is the evidence an access-review control asks for — rather than a screenshot of a spreadsheet assembled the week before the audit.
Related: CIEM produces the findings; access reviews are how they get decided.