# How is access profile composition supposed to be reviewed? **URL:** \ **Category:** Lifecycle & Governance\ **Tags:** certifications, access-modeling\ **Created:** [April 30, 2026, 7:11pm UTC](https://community.sailpoint.com/discuss/t/how-is-access-profile-composition-supposed-to-be-reviewed/59342 "2026-04-30T19:11:13Z")\ **Posts on this page:** 5\ **Page:** 1
**Author:** ![pillar224](https://sea3.discourse-cdn.com/sailpoint2/discuss/user_avatar/community.sailpoint.com/pillar224/32/18041_2.png) [@pillar224](https://community.sailpoint.com/discuss/u/pillar224)\ **Post date:** [April 30, 2026, 7:11pm UTC](https://community.sailpoint.com/discuss/t/how-is-access-profile-composition-supposed-to-be-reviewed/59342/1 "2026-04-30T19:11:13Z")
Our company is in the process of migrating to a RBAC model. This has drawn the attention of our auditors and regulators, rightly so, because it moves the bulk of the control from regular access item campaign to role composition campaigns (this is not my issue, this is by design and it’s good). In this process our auditors made the observation that it’s possible to include access profiles in role compositions, but the role composition campaign doesn’t review the composition of those access profiles, only the composition of the role itself is reviewed. This presents a concern because theoretically someone could change the composition of a role without it being detected by changing the composition of the access profile. This seems like a fairly obvious shortcoming, so I find it hard to believe this isn’t by design, and if it is by design then what’s the recommended approach to close the gap? ---
**Author:** ![amy\_shillinglaw](https://sea3.discourse-cdn.com/sailpoint2/discuss/user_avatar/community.sailpoint.com/amy_shillinglaw/32/17781_2.png) [@amy\_shillinglaw](https://community.sailpoint.com/discuss/u/amy_shillinglaw)\ **Post date:** [May 1, 2026, 6:07pm UTC](https://community.sailpoint.com/discuss/t/how-is-access-profile-composition-supposed-to-be-reviewed/59342/2 "2026-05-01T18:07:30Z")
Hi [@pillar224](https://community.sailpoint.com/user/86401) Keeping auditors happy is important! Access profile composition certification has been proposed as an Idea in our Ideas portal, is under consideration as a future feature, and I have actually voted on it before:  [https://ideas.sailpoint.com/ideas/GOV-I-1947](https://ideas.sailpoint.com/ideas/GOV-I-1947) When I review Roles, I can see access profiles and drill into them to see which entitlements are included in those access profiles. I can review all entitlements contained within the role, whether they are directly included or part of the access profile, then either approve or revoke the access profile from the role (but not the entitlements included within it). Is your organization’s experience different? I’m trying to determine what additional functionality might satisfy the auditors’ requirements. Any other details you might be able to provide by chance? If the primary objective is a report of access profiles with their included entitlements, you could use the [Access Profiles API](https://developer.sailpoint.com/docs/api/v2026/list-access-profiles/) to generate a list of access profiles. Obviously this is not a certification but it gets you the granular data. ---
**Author:** ![amy\_shillinglaw](https://sea3.discourse-cdn.com/sailpoint2/discuss/user_avatar/community.sailpoint.com/amy_shillinglaw/32/17781_2.png) [@amy\_shillinglaw](https://community.sailpoint.com/discuss/u/amy_shillinglaw)\ **Post date:** [May 1, 2026, 7:26pm UTC](https://community.sailpoint.com/discuss/t/how-is-access-profile-composition-supposed-to-be-reviewed/59342/3 "2026-05-01T19:26:11Z")
Couple of screen shots to show what I see: a.) Role composition dashboard with lists/tabs ![RoleComp1.png](https://cdck-file-uploads-global.s3.dualstack.us-west-2.amazonaws.com/sailpointsbx2/original/2X/9/9220705c3ff6fc9b981aadcc1b6cdd9f44064399.png) RoleComp1.png b.) Ability to revoke access profiles after reviewing their included entitlements: ![RoleComp2_APsWithEnts.png](https://cdck-file-uploads-global.s3.dualstack.us-west-2.amazonaws.com/sailpointsbx2/original/2X/c/c9030f115330a5af11091a8b5ffc420266875e9f.png) RoleComp2\_APsWithEnts.png From the role composition certification, there’s not a way to revoke specific entitlements from access profiles, just the whole/individual access profile(s). ---
**Author:** ![pillar224](https://sea3.discourse-cdn.com/sailpoint2/discuss/user_avatar/community.sailpoint.com/pillar224/32/18041_2.png) [@pillar224](https://community.sailpoint.com/discuss/u/pillar224)\ **Post date:** [May 6, 2026, 9:02pm UTC](https://community.sailpoint.com/discuss/t/how-is-access-profile-composition-supposed-to-be-reviewed/59342/4 "2026-05-06T21:02:35Z")
Hi Amy, Thanks for your response. I agree with you, when reviewers are reviewing the role composition, they can see the access profiles that make up the role, and they can even see the composition of the access profile, but they can’t actually change the composition of the access profile. They can either approve the entire access profile (and all of its entitlements) or revoke the entire access profile. ---
**Author:** ![amy\_shillinglaw](https://sea3.discourse-cdn.com/sailpoint2/discuss/user_avatar/community.sailpoint.com/amy_shillinglaw/32/17781_2.png) [@amy\_shillinglaw](https://community.sailpoint.com/discuss/u/amy_shillinglaw)\ **Post date:** [May 8, 2026, 3:20pm UTC](https://community.sailpoint.com/discuss/t/how-is-access-profile-composition-supposed-to-be-reviewed/59342/5 "2026-05-08T15:20:17Z")
For now, the role composition campaign is what we have. Hopefully you were able to vote on the idea. I will pass along feedback to the Product team that this is still a requested feature. I can see how to achieve this experience with the [access profile APIs](https://developer.sailpoint.com/docs/api/v2026/access-profiles) and perhaps an interactive workflow or custom UI, if one wished to go that route.