Stale access is access that remains assigned despite no longer being needed, used or supported by current identity and business context. It includes obsolete project access, inactive group membership, expired contractor permissions and rights left after a transfer.
IGA identifies stale access through lifecycle events, expiry, usage signals, policy comparison and review. Lack of recent use is evidence for investigation, not always proof that access is unnecessary.