Digital Nudges for Access Reviews: Guiding Deciders to Revoke Excessive Authorizations
summary
Formalizes access reviews with confusion metrics, runs expert interviews (n=10) to pick candidate nudges, and implements a Choice Defaults Nudge in a controlled user study (n=102): participants review 160 authorizations (50% excessive) under three preselection configs. Default-reject increases revocations, users do not blindly accept defaults, cognitive load and frustration drop, and completion time falls up to 24% time savings; overall accuracy does not improve unless defaults are smart defaults that preselect correct choices. Data are published open access.
AI-written summary · about
chapters (6)
- 0:00Digital nudges for access reviews
- 0:55Access reviews and challenges
- 3:03Problems in access reviews
- 5:12Expert insights on digital nudges
- 6:39Choice defaults in access reviews
- 10:15Takeaways and future research
related talks
10mDissecting Nudges in Password Managers: Simple Defaults are Powerful
11mEvaluating the Usability of Privacy Choice Mechanisms
15mEnhancing Privacy through the Visual Design of Privacy Notices: Exploring the Interplay
05mDeciding on Personalized Ads: Nudging Developers About User Privacy
16mPrivacy Review for Non-Maniacs
18mBad Metrics and Very Bad Decisions
50mYour Breached Controls May Have Been Reasonable After All
30mYour AI Has Too Much Access: Authorization for Coding Agents