Most frameworks require a periodic review proving the right people have the right access — and nothing more.
Access management pulls user and permission lists directly from your identity provider and routes them to the right manager for attestation on a recurring cycle (typically quarterly). Anything flagged for removal is tracked through to deprovisioning, and every step is captured as evidence.
Typical review cycle