Data access governance is software that maps which employees can open which folders and files, and shows how far a stolen account could reach. It then helps the company remove the access that nobody needs. It is a part of data security posture management (DSPM).
Access to shared folders grows quietly over the years. An administrator gives a whole department access to save time. A project ends, but its members keep their access. A folder is opened to everyone for one urgent day, and it stays open. Nobody has a full picture, because the permissions are spread across thousands of folders.
Consider a private university in Vadodara with 3,800 staff accounts. Its file server holds 12 lakh files. The tool reads the permissions on every folder. It also reads the group memberships in the directory, the master list of users and groups, such as Active Directory. It finds that the folder "HR/Salaries" is open to the group "All Staff". So any of the 3,800 accounts can open every salary file.
Then the tool asks the reverse question: what could one account reach? It takes an ordinary account, such as a research assistant's, and adds up every file that the account can open. The answer is 2.1 lakh files, including salaries and student marks. If an attacker stole that one password, all those files would be open to the attacker. This number is called the blast radius of the account.
The tool also reads the access logs, so it knows who actually opens each folder. In the last 180 days, only 6 people in the HR team opened "HR/Salaries". So the tool recommends removing "All Staff" and keeping access for those 6. Before anything changes, it shows which users would lose access, so that nobody's work stops by mistake. After the change, the research assistant's account reaches 9,000 files instead of 2.1 lakh.
Giving each account only the access it needs is called least privilege. Data access governance applies it to files and folders. Identity governance and administration (IGA) applies it to applications: it decides which logins a person gets on joining, and removes them on leaving. Identity security posture management (ISPM) maps permissions across all systems, starting from each account.