What it asks for. Requirement 7 of PCI DSS v4.0 limits access to system components and cardholder data to people whose job requires it. It covers defining an access control model, assigning access based on job function and least privilege, approving access, reviewing user accounts and privileges periodically and managing access for application and system accounts.
In practice. Organisations define roles and the access each role needs, use an access control system set to deny all by default, require documented approval for access and review accounts and privileges on a regular cycle. v4.0 adds explicit expectations for periodic reviews of user accounts and for limiting system and application account access. Evidence includes role definitions, approval records and completed access reviews.
Common gaps. Access reviews are often rubber stamped. Privileges accumulate as people move roles, and system accounts are frequently over privileged.