A preventive control stops an inappropriate action before it occurs. IGA examples include blocking a toxic access combination, rejecting an ineligible request, preventing self-approval and automatically expiring temporary access.
Preventive controls reduce exposure but require accurate data and carefully tested rules. Detective controls remain important for unmanaged systems, unexpected drift and control failures.