All papers / No. 01 / Certification & Attestation
Access certification asks managers and application owners to attest that user access remains appropriate, yet the review screen gives the reviewer almost nothing to decide with: no plain-language explanation of what an entitlement grants, no record of whether the access was used, and no comparison with what peers hold. The result is predictable: campaigns close at full completion with almost no revocations, and the control attests without informing. The gap is precise. Certification platforms route items to reviewers but do not supply decision evidence; published language-model research targets access decisions at the enforcement point rather than the periodic attestation that follows; and no framework defines how a language model can support the reviewer while the reviewer alone remains accountable for the decision. The paper answers with LLM-Assisted Access Certification (LAAC), a framework in which a language model prepares an evidence-backed briefing for each review item and the human reviewer makes and signs every decision. The model briefs. The human signs. The contributions are: (1) an analysis of the related work that locates the gap at the certification workflow itself; (2) the LAAC framework, stated as five design principles and a five-component reference architecture, with safeguards against automation bias grounded in human-factors research; and (3) a fully specified study design for evaluating whether briefings improve decision quality, offered as future work. The paper is conceptual: no experiments are reported and no empirical claims are made.
© 2026 Prabin Shrestha. Licensed under CC BY-ND 4.0: share unchanged with attribution; no derivatives.
Keep reading