Who reviewed this access request?

A vendor needs access by morning. The request looks routine; sales already promised it, IT has it queued, all that’s left is a yes.

Nobody asks who reviewed the scope.

This is how most over-provisioned access happens. Not a bad actor. Not negligence. Just convenience moving faster than scrutiny, one handoff at a time.

I’ve seen this pattern repeat across organisations of every size: by the time an access request reaches the person who can actually approve it, three people upstream have already assumed someone else checked.

The fix isn’t more approval steps. It’s one person, anywhere in that chain, willing to pause and ask “why does this need full access for a single-application task?”, even under deadline pressure, even when everyone above has already said yes.

The breaches that get stopped this way never make a report. Nobody writes a case study about the access that got scoped down before it became a liability.

That’s exactly why it’s worth talking about.

Where does “who reviewed this” usually get asked in your organisation, or does it get skipped?