We consider whether the new access is additive, providing the opportunity for a user to acquire access to IT application functions that create a segregation of duties concern, or if additional access requests trigger a complete reassessment of all access.