User Access Review and Recertification
Periodic access recertification depends on routing each user's access list to their manager for a yes/no decision, and that chain breaks constantly in practice — a manager who left the company with reports still pointing at them in the HR system, a reorg that hasn't been reflected in the identity platform yet, a manager on extended leave with no delegate assigned. When recertification tooling hits a broken chain, it commonly defaults to auto-approving the access because nobody said no, or leaves it stuck in permanent limbo, and both outcomes defeat the actual purpose of the review — one silently extends access that should have been re-evaluated, the other means the access review never actually completes.
STARTING PRICE
From €299
Standard tier · Multi-step workflow with AI extraction/decisioning and 2-3 integrations.
Get a quote →Saves roughly 6-9 hrs per recertification campaign, with far fewer stuck or wrongly auto-approved reviews.
How the automation works
We run recertification campaigns against your access and org data as usual, but when a manager approval chain is broken, whether that's no current manager on record, a manager who's left, or no response within the campaign window, the review routes to a defined fallback chain, such as the manager's manager, a designated access owner for that system, or a security team escalation, rather than defaulting to auto-approve or sitting unresolved indefinitely. Every fallback routing decision is logged with why the primary chain broke, so patterns of broken chains, like a department with consistently stale manager data, become visible and fixable at the source, not just repeatedly routed around. No access is auto-approved or auto-revoked purely because the standard chain failed; a person always makes the actual certification decision, just not necessarily the originally-assigned one.
Process flow
- 01
Recertification campaign opens trigger
A scheduled or ad-hoc access recertification campaign starts, pulling current access grants and reporting-line data for the scope in review.
- 02
Resolve manager chain integration
Each user's manager is checked against current HR and org data to confirm the approval chain is actually valid before routing the review.
- 03
Detect broken chains ai
Cases where the manager is no longer active, has no current record, or hasn't responded within the campaign window are identified as broken chains rather than treated as silent non-responses.
- 04
Route to fallback approver output
Broken-chain reviews route to a defined fallback — the manager's manager, a designated system access owner, or security team escalation — rather than defaulting to auto-approve or staying unresolved.
- 05
Certification decision output
A person, whether the original manager or the fallback approver, makes the actual keep/revoke decision on the access — no access is auto-approved or auto-revoked purely because the standard chain broke.
- 06
Log and surface chain-health patterns output
Every fallback routing is logged with the reason the primary chain broke, so recurring issues like a department with consistently stale manager data become visible and fixable, not just repeatedly worked around.
Inputs
- Current access grants
- HR and org reporting-line data
- Recertification campaign scope and schedule
- Designated fallback approver mappings
Outputs
- Completed recertification decisions
- Fallback routing log with break reasons
- Chain-health pattern reporting
- Access certification audit trail
Works with
Prefer a fully custom build instead of an off-the-shelf integration? We scope both options during your free consultation — most jobs like this one work fine on standard connectors, but higher-volume or non-standard systems sometimes need bespoke API work, reflected in the complex tier.
Where this goes wrong if you get it wrong
- Defaulting a broken approval chain to auto-approve is the single most dangerous fallback in access recertification — it means access nobody actually reviewed gets silently extended, which is precisely the outcome the review exists to prevent, and it tends to happen exactly in the cases, like org changes or departures, where access is most likely to be stale.
- The opposite failure, access stuck in permanent limbo because no valid approver could be found, means the recertification campaign never actually completes and access sits in an unreviewed, ambiguous state that's just as bad for audit purposes as a wrongful auto-approval, just less obviously dangerous.
- A fallback chain that always routes to the same generic security-team queue regardless of context will overload that team and slow the whole campaign down — the fallback needs a reasonable resolution order, such as the manager's manager first and then a designated system owner, with security escalation as a last resort, not the default for every broken chain.
- Broken chains are often a symptom of a deeper data problem, such as HR and identity platform data out of sync after a reorg, and a recertification tool that keeps quietly routing around broken chains without surfacing the pattern lets the underlying data problem persist indefinitely instead of getting fixed at the source.
Frequently asked questions
What happens when a manager has left the company but still shows as the approver?
The chain is detected as broken and the review routes to a defined fallback, typically the manager's manager or a designated system access owner, rather than defaulting to auto-approve or getting stuck with no valid approver.
Does broken approval routing ever result in automatic access approval or denial?
No — a person always makes the actual certification decision, whether that's the fallback approver or a security team escalation; the automation's role is routing around the broken chain, never deciding the outcome itself.
How do we know if broken chains are a recurring problem?
Every fallback routing is logged with why the primary chain broke, so patterns, like a specific department with consistently stale manager data, become visible in reporting instead of just getting quietly worked around campaign after campaign.
Does this integrate with our existing IAM tooling?
Yes, it layers chain validation and fallback routing on top of your identity and access management platform's existing recertification data, rather than replacing the system of record for access grants.