Which term corresponds to the description 'Summarizes roles instead of granular access details'?

Which term corresponds to the description 'Summarizes roles instead of granular access details'?

• A. Capability Maturity Model
• B. IAM Strategy
• C. Access Request Validation
• D. Access Review Reports

Answer: (D)

Access Review Reports describe access in a high-level, grouped way—focusing on roles rather than listing every granular permission. In access governance, these reports are used during attestation cycles to summarize what a user has by role or entitlement category, making it easier for managers to review and certify whether the access is still appropriate. This aligns with the description of summarizing by roles instead of detailing every individual permission. The other options don’t fit this description as well. A Capability Maturity Model relates to how mature an organization’s processes are, not to reporting access by role. An IAM Strategy is about the overall plan for managing identities and access, not the specific reporting artifact. Access Request Validation concerns approving or denying a particular access request in real time, not providing a summarized, role-based view for attestation.

Access Review Reports describe access in a high-level, grouped way—focusing on roles rather than listing every granular permission. In access governance, these reports are used during attestation cycles to summarize what a user has by role or entitlement category, making it easier for managers to review and certify whether the access is still appropriate. This aligns with the description of summarizing by roles instead of detailing every individual permission.

The other options don’t fit this description as well. A Capability Maturity Model relates to how mature an organization’s processes are, not to reporting access by role. An IAM Strategy is about the overall plan for managing identities and access, not the specific reporting artifact. Access Request Validation concerns approving or denying a particular access request in real time, not providing a summarized, role-based view for attestation.