An employee receives a promotion that entities them to access higher-level functions on the company's accounting system, as well as keeping their access to the previous system that is no longer needed

Access provisioning refers to the process of granting access rights to users when needed, not the process of reviewing and removing excess or outdated privileges.

Segregation of Duties (SoD) is a control principle that ensures no single individual has conflicting or overly powerful combinations of access that could enable fraud, but it does not describe the review process for removing accumulated excess privileges.

Access certification is the periodic review process that validates whether users' current access rights are still appropriate and necessary for their job function. In this scenario, the employee retained legacy access after a promotion, and access certification would flag and revoke that no-longer-needed privilege. This process directly addresses 'privilege creep,' where accumulated entitlements exceed what is required for a user's current role.

Access aggregation (also related to privilege aggregation or 'privilege creep') describes the problem of accumulating excess access over time, but it is not the name of the remediation process used to remove those excess privileges.