Access certification is a recurring review of user, service, or application permissions to decide whether access should be approved, removed, or left in place based on current business need. It is a core identity governance control because access often outlives the role that justified it.
In security programs, certification helps reduce excess privilege, stale accounts, and unauthorized access paths that attackers can exploit after credential theft or insider compromise. Reviewers compare entitlements with job duties, ownership records, and risk rules, then trigger remediation when access is no longer appropriate. Poorly run certifications can fail when reviewers approve too much or when entitlement data is inaccurate, so good programs focus on accurate inventories, clear ownership, and evidence that removals were completed.