Access accumulates; it rarely self-corrects
A permission granted for a specific project, a temporary role, or a one-off task is easy to grant and easy to forget about once its original purpose has passed — removing access requires someone to notice it's no longer needed and take deliberate action, while leaving it in place requires nothing at all. That asymmetry is why access, left alone, tends to only grow over time rather than track a person's actual current responsibilities.
This drift is largely invisible from inside the day-to-day process that causes it. No single grant looks excessive in isolation; the pattern is only visible when someone deliberately steps back and compares an account's total access against what its current role actually requires.
A review has to be scheduled, not triggered by hope
A periodic access review forces that comparison on a set cadence rather than waiting for an incident or an audit to surface it. The review that matters most isn't the one checking whether departed employees still have active accounts — that's the easy case — but the harder one checking whether current employees' access still matches their current responsibilities, which is where entitlement creep actually accumulates.