Silence removes access. A campaign whose no-response path is approval measures reviewer engagement and nothing else.
Reviewers are named people — a resource owner or a line manager — never a shared queue. A queue reviews nothing.
System recommendations carry a 30-day inactivity signal so a reviewer sees evidence rather than only a name, which is the difference between a decision and a rubber stamp.
Cadence
Privileged roles every 30 days, applications and guests every 90, everything else annually. Cadence follows blast radius, not calendar convenience.
Coverage today is 100% of privileged roles and 98% of applications. The missing 2% are applications with no identified owner, which is the real finding.
Exceptions are documented, capped at 14 days, owned by a person, and automatically re-reviewed next cycle.
Risks
Reviewer fatigue causes bulk approval. Mitigated by batching reviews to no more than 25 items per reviewer per campaign and by showing the inactivity signal first.
Self-attestation is permitted only for low-risk access. It is drawn in red because it is a control that reviews itself.
Removal on no-response will occasionally break someone's legitimate access. The reinstatement path is a standard request, and the breakage rate is tracked as a quality metric rather than treated as a failure of the policy.
