An entitlement review is a periodic check of the permissions, roles, and access rights already assigned to a user, supplier, service account, or AI agent. The goal is to confirm that each entitlement is still necessary, still appropriate, and still limited to what the identity truly needs. In practice, this is a core governance control in IAM.
Entitlement reviews matter because excessive or stale permissions are a common path to misuse. Attackers often benefit from accounts that keep old access long after a job change, contract ends, or project closes. Security teams use reviews to spot privilege creep, remove unnecessary access, and enforce separation of duties. They also help validate third-party and non-human identities, where hidden permissions can be harder to notice but just as dangerous.