Access in most organizations only moves one way. Someone needs a thing, asks for it, and gets it. Later they stop needing it, and nothing happens, because there is no moment at which not-needing-something generates a request. Grants have a requester. Revocations have nobody.

That asymmetry is the whole story. It isn’t a policy failure or a lax culture; it’s arithmetic. If one direction of change is driven by demand and the other is driven only by periodic diligence, the system integrates in the direction of demand. Audit once a quarter and you’re applying a small corrective force against a continuous one. The steady state is not “appropriate access.” The steady state is “everything anyone has ever plausibly needed.”

The usual diagnosis is that people are careless about cleanup, which misreads the incentives badly. Removing someone’s access is an action with a clear downside — you might break their work, and they’ll come tell you about it — and no visible upside, because the risk you reduced is counterfactual and silent. Nobody has ever been thanked for the breach that didn’t happen. Every removal is a small bet against a colleague, made by someone who gains nothing if they’re right.

So the fix isn’t exhortation, and it isn’t more reviews. It’s removing the human from the revocation path entirely, which means grants have to carry their own expiry from the moment they’re issued. Time-boxed by default: access to this thing, for this reason, until this date. The renewal is the review. Whoever still needs it asks again, which takes thirty seconds, and everything nobody asks about evaporates on its own. The default flips from permanent-until-someone-objects to temporary-unless-someone-insists, and the drift reverses without anyone having to make an unpopular call.

The objection is that expiring access breaks things at inconvenient moments, and it does, occasionally. But notice what that objection concedes: you don’t actually know which grants are load-bearing. If you did, the expiry would be a formality for the ones that matter and a silent cleanup for the rest. The breakage isn’t a cost of the mechanism; it’s the mechanism surfacing information you didn’t have — a dependency you were carrying without knowing it. Better to learn that on a Tuesday from a renewal prompt than during an incident where the access map turns out to be much wider than the org chart.

The generalized version is worth keeping: any system where additions are requested and removals are merely encouraged will accumulate without bound. Permissions are the sharpest case because the accumulation is invisible and the failure mode is severe, but feature flags, cron jobs, dashboards, and integrations all follow the same gradient. Wherever you find something that only grows, look for what’s missing on the other side — and it’s almost never discipline. It’s a requester.