You can now control exactly who signs off on an access review, what they're agreeing to, and how granular that sign-off is. Choose between three modes: let each reviewer self-attest their own work, require a separately designated person to countersign each account set, or have one person certify the entire review once every set is in. Set an org-wide default, then override it per campaign or per cycle so routine reviews stay light while quarterly compliance certifications can be stricter. Once a cycle starts, its settings are locked, so later changes to your defaults never affect a review already in flight.

You can also tailor the statements each signer must confirm: edit the wording, add or remove statements, reorder them, and mark each as required or optional. Statements can include real values like the cycle name and resource name, captured at the moment the sign-off is recorded so the historical record shows exactly what was agreed.