Entitlement strings are not English: the comprehension gap in access governance

Access certification assumes the reviewer can understand what they are certifying. Nothing in the process tests that assumption, and the entitlement catalogue in most enterprises makes it false for the majority of items.

Part of Access governance and certification

The moment the campaign fails

A finance manager opens her certification campaign on a Thursday afternoon. Item fourteen of two hundred and six reads SAP_FI_AP_POST_ALL. She manages accounts payable clerks. She has no idea whether this is the permission that lets them do their job or the permission that lets them pay themselves.

She has four options: approve it, revoke it and risk breaking someone's work, ask someone and wait, or leave it and come back — which means missing the deadline.

Three of those four options produce a decision that the record will treat as informed. The fourth produces a completion-rate problem for the programme owner.

Why entitlements are named this way

Not carelessness. Entitlement identifiers are generated by the systems that own them, for the engineers who administer them, following naming conventions that encode environment, object, operation and scope. PRD-DB-RW-FIN-02 is informative to a database administrator.

The certification interface renders whatever the connector retrieves. If the source system holds no business-language description — and most do not — there is nothing else to display.

The Decidability Score

Count it. The query is straightforward and the result changes the conversation.

Run it across your catalogue and report the share at level 3 or above. In most enterprises it is a minority, frequently a small one, and the number is what funds the enrichment project that has been deferred for three years.

Why enrichment alone does not close it

Suppose you fund the project and improve descriptions. Good — reviewers make better decisions from now on.

Now an auditor asks about a certification completed last quarter, before the enrichment. What was the reviewer shown? The catalogue now holds a good description; it did not then, and the certification record does not store what was displayed.

This is the same structural gap that appears throughout this series: the system stores current state, and the question is about a past rendering.

Binding the rendered text

Include the descriptions as shown in the signed attestation, not just the entitlement identifiers.

{
  "type": "manav-stmt/1",
  "action": "access_certification",
  "campaign": "[id]  Reviewer: [named]",
  "items": [
    { "entitlement": "SAP_FI_AP_POST_ALL",
      "description_shown": "Post accounts payable documents in all company codes",
      "decision": "approve" }
  ],
  "items_hash": "[hash of the full rendered set]",
  "reviewer": "[credential assertion]"
}

Two consequences follow. An auditor can see exactly what the reviewer was told. And a reviewer shown a level-0 entitlement can legitimately decline it as undecidable — which creates the first feedback loop the enrichment backlog has ever had.

The undecidable decision

Adding a third option alongside approve and revoke changes the programme's economics. Cannot determine — insufficient information routes the item to the entitlement owner rather than to a coin flip.

Programme owners resist this because it damages completion rates. That resistance is the clearest evidence available that completion rate is the wrong metric: an item a reviewer genuinely cannot assess should not be counted as certified, and counting it is how the artefact became meaningless.

A sequencing note

Do not bind rendered descriptions before improving them. Binding first means faithfully recording that your reviewers were shown nothing useful, which is an accurate record and a poor look.

Score first, enrich the high-risk subset, then bind. That order produces an artefact worth having and an enrichment project scoped by risk rather than by catalogue size.

A decidability score for entitlements

Scoring entitlements by how decidable they are lets a programme fix the worst first. An entitlement with no description, no usage data and no peer context should not be in a campaign at all until it has them.

Objections and honest limits

“Reviewers can look it up.” Across hundreds of items, under a deadline, in a separate system. They will not, and designing as though they will is what produces the rubber stamp.

“Descriptions are a data quality project.” They are, and it is the project that determines whether the whole control means anything. Campaign frequency without decidability produces artefacts rather than decisions.

Making entitlements decidable

1. Score every entitlement for decidability. Description, usage, peer context, blast radius.
2. Exclude undecidable ones from campaigns. Reviewing them produces noise, not evidence.
3. Fix the highest-risk undecidable ones first. Risk times undecidability is the priority order.
4. Show the four inputs in the review interface. Not in a linked system.

Terms used here

Entitlement

A specific permission granted to a user, usually represented by a system identifier rather than a description.

Decidability

Whether a reviewer has enough information to make an informed approve-or-revoke decision.

Peer comparison

How many comparable users hold the same entitlement — context that makes an outlier visible.

Frequently asked questions

Can AI generate the descriptions? It can draft them, and the provenance of the description then matters — a generated description that is wrong is worse than none. Whatever generates them, the text shown should be bound into the attestation.

Should reviewers really be able to decline items? Yes. An item a reviewer cannot assess should not be recorded as certified. The completion-rate cost is the point, not a side effect.

How long does scoring take? An afternoon for a sample, longer for a full catalogue. Sample first; the distribution is usually clear at a few hundred items.

Does role mining solve this? It reduces item counts, which helps reviewer load. It does not make the remaining items comprehensible, and a poorly described role is worse than a poorly described entitlement because it bundles more.

Why do reviewers approve by default? Because revoking something they cannot interpret risks breaking someone's work, and approving has no immediate cost.

What is the single most useful data point? Last-used date. An entitlement unused for a year is the strongest available revoke signal.

What should happen to undecidable entitlements? Exclude them from campaigns until they have a description, usage data and peer context. Reviewing them produces noise.

Sources and further reading

• FTC — business guidance on marketplaces and consumer protection
• Published research on access review comprehension and review fatigue.
• PCAOB AS 2201 — An Audit of Internal Control Over Financial Reporting
• ISACA — identity and access management audit resources
• NIST SP 800-53 Rev. 5 — access enforcement