War-game an access review cadence by proving each privilege class has a named reviewer, a measured age-out, and a reverse path before the calendar starts governing every grant.
Access review cadences fail when "on schedule" means a checkbox without a decision artifact, when teams dual-count a draft as both reviewed and live, and when high-privilege paths still pin to one thin roster because the map is incomplete. The review needs one written inventory of access classes, one owner who can deny a risky grant, and a documented consequence when a failed review ages past the deadline.
Map the cadence before seating
List access classes by system, review window, reviewer roster, last skip reason, owner of record, and evidence required to keep the grant. Attach open findings, overdue reviews, and any emergency access waiver in the last quarter. Name which classes are out of scope and why. If a production admin class is omitted, show the residual risk in the same packet.
Decide allow, revise, or hold in advance. Include the fields that compute overdue-review status so two reviewers reach the same label from the same exports.
Decision gates
- Roster proof. Every critical class has at least two named reviewers who completed a timed dry run in the last quarter.
- Age-out proof. Exports show when each grant expires and who receives the overdue alert.
- Exception proof. Logged exceptions list owner, expiry, and restore path; shared overrides fail the gate.
- Conflict proof. No reviewer certifies their own standing privilege without a second set of eyes.
- Abort proof. A named person can freeze grants at week end without waiting for the system owner.
Run four cases in Pingpong: a system still pinned to one overloaded reviewer, a grant that left a partner admin live without security review, a class that mixed interactive and service accounts, and a request to skip a production class because volume is rare. Start from the documented cadence language. Ask who can extend a review window and which export proves completion. Any step that depends on an unnamed person becomes a freeze condition.
Replay one prior access incident under the proposed rules. If the incident would still age without a reverse owner, revise the rules before calling the cadence ready.
Pair with the security ops lead seat, a privileged access review, and a secrets rotation drill stress test. More operating decisions live in the war-game decisions hub.
Close only when approved and blocked labels can be reproduced from stored exports without a verbal override.