Glossary
User access review
A user access review is a regular check, by people who know the work, that each person still needs the access they have.
A user access review is how an organization checks, on a schedule, that the access people hold is still the access they need. Someone who knows the work looks at each account and at each thing it can do, and says keep, remove or change. The answer is written down. PCI DSS, ISO 27001 and SOC 2 ask for it; the guide says what each wants.
Why it matters
Access piles up. People change teams, finish projects and leave, and most systems never ask whether an access is still needed. Nothing takes it back unless someone looks. A review is the moment someone looks. It catches the engineer who still holds an admin role from an incident last spring, and the account of someone who left.
A review only means something with three things behind it: a list that covers everyone in scope, a reviewer who knows the work and is not the person who holds the access, and a follow-through that removes what was rejected. It also leaves a record of what was listed, who decided and what changed. Without the record, a review that happened is hard to show.
An example
Marcus moved from billing to support in March. In the June review, his manager sees that he still holds billing-admin in Keycloak. She chooses remove and writes “moved to support”. An administrator takes the role away in Keycloak, and the next list does not show it. The guide on how to run a user access review in Keycloak shows how to get that list.