A security auditor requires that department managers periodically review a report listing every user in their group and the permissions each user holds, confirming that the access is still appropriate for each employee's current job role. Which identity and access management activity does this describe?