Removing or restricting rights to use an IT Service is the responsibility of which process?

Access Management controls the entire lifecycle of user rights to IT services, which explicitly includes granting, modifying, and revoking access. When a user's role changes or they leave the organization, Access Management is the process responsible for removing or restricting those permissions. This protects the confidentiality and integrity of data and services.

Incident Management is responsible for restoring normal service operation as quickly as possible after an unplanned interruption, and does not manage user access rights.

Request Fulfillment handles standard, pre-approved service requests from users - it may initiate an access request, but the actual granting or revoking of rights is executed by Access Management.

Change Management governs the process of controlling the lifecycle of all changes to IT infrastructure and services, not the administration of individual user access rights.