First there is no built-in mechanism to enforce an attestation policy or help perform the access reviews. Microsoft Windows Server and Microsoft Active Directory use groups as the basic mechanism to control access to resources, and most non-Microsoft operating systems and directories use them as well. Because groups are universally accepted as the method by which users are authorized to use a resource, many vendors provide the ability for group attestation as part of access management solutions. This functionality is intended to satisfy audit or security requirements.   

Unintended Access Senarion (Click to enlarge)