Effective access is the complete set of resources a user can actually reach once every path is accounted for: direct grants, group memberships, and everything inherited through nesting, plus the licenses granted by their direct memberships. It is the security-relevant truth, and no single native list displays it.
Why effective access diverges from apparent access#
Apparent access is what a reviewer sees looking at one group or one assignment. Effective access is the union across every chain, and the divergence grows with structure: overlapping groups, nested hierarchies, and mixed license models each add paths a single view misses.
Access reviews conducted on apparent access approve what they can see and silently renew what they cannot, which is how stale access survives review after review.
VisualizerEngine
Effective access in VisualizerEngine
The graph shows every path a user sits on, license inheritance mapping shows each grant's chain, and structural search asks effective-access questions directly, like which users reach a given group through any path. Reviews conducted on the whole picture renew what is actually held, not what happens to be visible.