Periodic certification that people still have the access they should. Reviewers attest keep or revoke — access stays tidy as you grow.