Permissions accumulate. Someone needs temporary access for a project and keeps it for years. A service account created for a test still holds broad rights. A group grows until nobody remembers why a particular person belongs to it. Periodic access reviews are the routine that keeps these small accretions from becoming real exposure. This article lays out a review you can run each quarter, with notes on what to examine and what evidence to keep.

Why Reviews Matter More in the Cloud

On-premises, access often hinged on a few systems and a physical network. In cloud data platforms, access can flow through storage permissions, warehouse roles, notebook workspaces, catalog entries, pipeline credentials and shared links, each with its own model. Because resources are easy to create, so are overlooked grants. A review gives you a deliberate moment to ask whether every permission still has a reason to exist.

This article offers general guidance. Regulatory expectations for access control and audit evidence vary by jurisdiction and industry, so confirm specifics with compliance or legal advisers.

Prepare the Review

Before examining permissions, set the scope and the rules.

1. Pick a scope. Start with the most sensitive datasets, not the entire estate.
2. Identify reviewers. Data owners are best placed to say whether access is still appropriate. Reviewers should not be asked to approve their own access.
3. Export current access. Gather who and what can reach each dataset, including groups, roles and service identities, from your platform’s access reports.
4. Set a deadline. Reviews that drift on indefinitely do not finish.

What to Examine

Human users

For each person with access to sensitive data, ask whether their current role still requires it. Pay attention to people who changed teams, contractors whose engagements ended and anyone who has not used their access in a long time.

Groups and roles

Check group membership against its stated purpose. Overly broad groups, such as one containing most of the company, deserve special scrutiny. Prefer assigning access to well-defined roles, then managing membership.

Service accounts and credentials

Non-human identities often hold more power than people and are reviewed less. List them, confirm each has an owner and a purpose, remove those that are unused and check that credentials are rotated according to your policy. Prefer short-lived credentials over long-lived keys where your platform supports it.

Sharing and external access

Look for links, cross-account grants and shares that expose data outside the team or organization. Confirm each is intentional and still needed.

Privileged and administrative rights

Administrative access should be rare, justified and monitored. Ask who can change permissions themselves, since that capability can undo every other control.

The Checklist

Area	Question to answer	Evidence to keep
Users	Does each person still need this access?	Reviewer decision and date
Leavers and movers	Was access removed on role change?	Offboarding comparison
Groups	Does membership match purpose?	Group membership export
Service accounts	Does each have an owner and purpose?	Inventory with owners
Credentials	Are keys rotated or short-lived?	Rotation records
External sharing	Is each outside share intentional?	Share list with approvals
Admin rights	Who can change permissions?	Privileged access list
Logging	Are access events recorded?	Log configuration

Handle Findings Calmly

Most findings are ordinary: access that was never revoked, not malice. Treat the review as housekeeping, and give owners a clear window to object before removal. For access whose purpose nobody can explain, a reasonable approach is to disable it, watch for complaints for a short period and delete it if none arrive. Keep a record of what was removed and why so you can restore access quickly if a legitimate need emerges.

For anything that looks like genuine misuse or a possible incident, follow your organization’s security incident process and involve your security team rather than investigating alone.

Keep Evidence Without Creating a Burden

Auditors and internal stakeholders often want proof that reviews happen. Save the exported access lists, reviewer decisions with timestamps, and a summary of changes. Store them somewhere controlled and consistent. A short summary document each cycle is usually sufficient, though your specific obligations may require more.

Make the Next Review Easier

Reduce manual effort over time. Tag datasets by owner and sensitivity so reviewers see only what they are responsible for. Grant access through groups and roles, which are easier to review than individual grants. Automate expiry for temporary access so it ends without anyone remembering. Alert on unusual changes, such as new broad grants on sensitive data.

A Realistic Example

Consider a hypothetical data team reviewing access to a confidential customer dataset. The export shows a former contractor still in a project group, two service accounts with no recorded owner and a shared link created for a one-time analysis. The data owner confirms the contractor’s access can go, and the team removes it. They disable the unowned service accounts, and when nothing breaks after a couple of weeks, delete them. The shared link is revoked. They also replace several individual grants with a role tied to the analyst team and set an expiry on future temporary access. The whole review fits in an afternoon, and the notes become the template for next quarter.

Frequently Asked Questions

How often should access reviews happen? Quarterly is common for sensitive data, with less frequent reviews for lower-risk data. Your regulatory or contractual obligations may set a minimum.

Who should perform the review? Data owners or their delegates, supported by IT or security for the technical export. Avoid having people review their own access.

What about access nobody can explain? Disable it first, monitor briefly and delete if nothing depends on it. Record the decision.

Are service accounts really part of this? Yes. They are frequently over-privileged and under-owned, and compromised credentials for them can expose a lot of data.

Can this be automated? Parts of it, such as exporting access, flagging unused permissions and expiring temporary grants. The decision about whether access is appropriate still benefits from human judgment.

Next Step

Choose your single most sensitive dataset, export who and what can access it, and send the list to its owner with a one-week deadline for confirmation. Remove or disable whatever cannot be justified, and save the record as your first review.