GOV-15: Periodic access review
In short: Review each agent's access at least quarterly, with its named owner confirming or removing every permission and tool. Access drifts as agents gain tools and projects change. A scheduled review catches the drift and produces evidence that someone checked, for the auditors.
What does GOV-15 require?
Review each agent's access at least quarterly, with its named owner confirming or removing every permission and tool.
Why does it matter?
Access drifts as agents gain tools and projects change. A scheduled review catches the drift and produces evidence that someone checked, for the auditors.
How do you test it?
- Ask for the last completed review and its date.
- Confirm each line was decided by the named owner.
- Check that removals were actually applied afterwards.
Which platforms document GOV-15?
Documented by Clutch Security.
- 6.35Clutch Security documentedSource: Clutch Security platform, read
- 6.85Descope partly documentedSource: Descope Agentic Identity Hub 3.0, read
- 9.10NewCore not found in public materialChecked: NewCore: Discover; NewCore: Secure; NewCore: Govern; NewCore: Identity foundation; NewCore emerges from stealth; NewCore on AWS Marketplace, read
- 8.35Silverfort not found in public materialChecked: Silverfort: AI Agent Security; Silverfort unveils AI Agent Security; Silverfort and Google Cloud Agent Gateway; Silverfort pricing, read
- 7.30Astrix Security not found in public materialChecked: Astrix at RSAC 2026; Astrix product; Cisco and Astrix Security, read
- 7.30Cyera Identity not found in public materialChecked: Oasis Agentic Access Management; Cyera completes Oasis Security acquisition, read
- 6.55Aembit not found in public materialChecked: Aembit home; Aembit IAM for Agentic AI is generally available; Aembit pricing, read
- 6.55Token Security not found in public materialChecked: Token Security home, read
- 6.55SailPoint Entro not found in public materialChecked: SailPoint agentic AI security; SailPoint closes Entro Security acquisition, read
- 5.50Idira not found in public materialChecked: Palo Alto Networks introduces Idira; CyberArk Secure AI architecture docs; Palo Alto Networks completes CyberArk acquisition, read
Which framework references apply?
No framework mapping is confirmed for this control yet. See the framework crosswalks for what we checked.
Which controls are related?
- GOV-02Named accountable owner
- GOV-12Decommission at task end
- GOV-20Change management for agent permissions
Glossary: accountable owner, access review, certification campaign, ai management system.
Reviewed by The Register desk