Access governance is the process of defining, approving, reviewing, and removing access to an organization’s systems and data. It establishes who should have access, what they may access, why they need it, and when that access should end. For third-party vendors, those decisions need additional context.