One question we’re often asked is: why do we need to perform User Access Reviews when RBAC is already in place?

The honest answer is — not just for audits or compliance like ISO 27001 or SOC 2. User Access Reviews exist to manage very real, day-to-day risk that builds up over time.

Even with RBAC, access tends to drift. People leave the organization and their access sometimes stays active. Others change roles or teams, but older permissions don’t always get revoked. Temporary or emergency access is granted for a specific purpose and quietly never removed. Over time, access no longer reflects what people actually do.

RBAC defines what a role can access, but it doesn’t automatically confirm:

• Whether the right users are assigned the right roles.

• Whether access still matches current job responsibilities.

• Whether any temporary access should have expired.

• That’s where User Access Reviews come in.

• Access reviews also don’t need to be done the old-fashioned way — line-by-line permission reviews that nobody enjoys.

A more effective approach is to:

Review roles and the access mapped to them

Validate that users have appropriate roles for their current responsibilities

Identify and revoke temporary access that is no longer required

Pay closer attention to privileged or sensitive roles

In short, RBAC sets the structure, but User Access Reviews keep it accurate over time.

Without regular reviews, even a well-designed RBAC model slowly drifts — and that’s where risk starts to creep in.