While the system you describe sounds very well engineered, I have yet to see a system involving humans follow engineering rules. If I understand your posts, you will have a tightly defined set of roles, tied to job title/department, I assume. From these business roles, permissions roles will follow, tightly coupled. Therefore, HR can manage the assignment, and the application owners can manage the roles' permissions definitions. That seems wonderful, but a recipe for disaster to me. Being that, someone's manager/director/vp is going to want them to do x, y and z. This is going to require a shift in their permissions, now you have a special case. Within a year, you have dozens, and the whole thing falls apart under it's own weight. That has been my experience. As a general rule, I think what you are setting up (provided I understood it correctly) is a great default, and making sure that whatever process allows exceptions puts the burden on the management to define and explain the need, it should work in general. But make sure it can support exceptions, unless you are in a very, very controlled environment. On a secondary note, I think management should always be at least partly responsible for the access review. It is their responsibility to support the business, and to protect it. They can't do that if they aren't in the loop.
