> ## Documentation Index
> Fetch the complete documentation index at: https://docs.lumos.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Understanding Categories in the Access Review

### Overview

In Lumos, the **Categories** column highlights accounts with elevated risk or requiring special attention. Below is a breakdown of each category, what it means, and how Lumos identifies it.

| **Category** | **What It Means** | **How Lumos detects it** |
| - | - | - |
| **Privileged** | This means the user likely has some kind of "admin" access to the app. | Lumos scans entitlement names for keywords like `"Admin"`, `"SuperUser"`, or `"Super User"`.    See how this Tag is applied to Permissions [here](/kb/ui-ux/adding-tags-to-permissions#privileged-tag). |
| **Terminated** | The employee is no longer with your company. | Detected via inactive employment status from your source of truth (e.g., HRIS, IdP). |
| **Service Account** | Lumos detected that the account is a system/service account in the app. | Based on the Identity Type configured in Lumos. See [Managing Identities](/kb/appstore/source-of-truth/managing-identities)for more details on tagging service accounts. |
| **Unmatched** | The account isn't linked to an employee. Usually these are guest accounts, system/service accounts, or contractor accounts. | Lumos flags accounts not associated with any source-of-truth identity. |
| **SOD Violation** | The account has entitlements that conflict with a Segregation of Duties (SoD) policy. | Lumos calculates this using the SoD rules defined in your environment. |

## Why it matters

Categories help reviewers prioritize action - highlighting accounts that are risky, misconfigured, or not clearly owned.