In identity management, what is the purpose of an account owner or sponsor?

• A. The owner is responsible for password resets only.
• B. The sponsor can approve any access without review.
• C. Owners manage device compliance.
• D. Each account has an owner/sponsor who approves access; maintain role separation and auditability.

Answer: (D)

Access governance hinges on designating an account owner or sponsor who oversees who can access a given resource. This person is responsible for reviewing requests, approving access based on the user’s role, and ensuring that permissions stay aligned with what the job actually requires. By having an owner, you create accountability—there’s a specific individual who can be contacted about access decisions, and their approvals can be traced in audit logs. This also supports separation of duties: the person who approves access is part of a distinct step in the process, reducing the chance of abuse and making it easier to review and verify who authorized what, when, and for whom.

That framework is what the option captures: each account has an owner or sponsor who approves access, with an emphasis on maintaining role separation and auditable records. The other statements miss the broader governance role—password resets are just a routine operation, approving any access without review breaks control and auditability, and device compliance is a separate concern from access provisioning.