Understanding Categories in the Access Review

Overview

In Lumos, the Categories column highlights accounts with elevated risk or requiring special attention. Below is a breakdown of each category, what it means, and how Lumos identifies it.

Category	What It Means	How Lumos detects it
Privileged	This means the user likely has some kind of “admin” access to the app.	Lumos scans entitlement names for `"admin"` or `"owner"` (not case-sensitive). See how this Tag is applied to Permissions in Adding tags to permissions.
Terminated	The employee is no longer with your company.	Detected via inactive employment status from your source of truth (e.g., HRIS, IdP).
Service Account	Lumos detected that the account is a system/service account in the app.	Based on the Identity Type configured in Lumos. See Managing Identitiesfor more details on tagging service accounts.
Unmatched	The account isn’t linked to an employee. Usually these are guest accounts, system/service accounts, or contractor accounts.	Lumos flags accounts not associated with any source-of-truth identity.
SOD Violation	The account has entitlements that conflict with a Segregation of Duties (SoD) policy.	Lumos calculates this using the SoD rules defined in your environment.

Why it matters

Categories help reviewers prioritize action - highlighting accounts that are risky, misconfigured, or not clearly owned.

NHI Security

MCP Governance

Lumos AI

Applications & Entitlements

Access Policies & Lifecycle Management

AppStore

Access Reviews

Identity Agent Force

Analytics

Platform Administration

Understanding Categories in the Access Review

Overview

Why it matters

​Overview

​Why it matters

Overview

Why it matters