At the quarterly access review the security lead asks a fair question: what has changed in appliance access since the last review? Nobody can answer. Which operating habit turns that question into a fifteen-minute exercise every quarter from now on?

Answering 'what changed' quickly is a rhythm, not a document: a recurring entitlement review that diffs the appliance's live accounts and roles against the as-built identity register and the directory group memberships, so each cycle begins from the last signed-off state and every delta - a departed employee's account, an ownerless service identity, an over-mapped group - surfaces as an exception line. The review is also the forcing function that keeps the register itself honest, since unrecorded changes are exactly what the diff exposes. A quarterly penetration test is valuable but orthogonal: it hunts exploitable paths from the outside and will report that a stale admin account still works, yet produces no reconciliation of entitlement against record - precisely what the security lead asked for. A go-live screenshot is a baseline with an expiry date - it anchors the first cycle and quietly becomes false after every change since, which is how the team arrived unable to answer this quarter. Requiring a ticket per account change is sound process hygiene but not a record of state: emergency access, vendor sessions and off-process fixes skip tickets, and the review is the control that catches what the process misses. Exam caveat: sign and keep each cycle's output as the next cycle's baseline, so drift stays bounded in both directions. Operational check: run the three-way diff, list the deltas, and record for each whether it is approved-but-unrecorded or unauthorized.