IAEA inspectors spent around 3000 man-days a year in Iran.
The Iranian leadership declared military sites off-limits to the inspectors. Prior to the signing of the agreement, at least one of these sites was known to include a nuclear research facility.
Given this, how did the IAEA confirm compliance with the JCPOA at these sites?
It appears that the IAEA entered into a self-certification agreement with the Iranian authorities for the Parchin complex, at which nuclear testing was known to be being performed. Perhaps this was the compliance-checking mechanism used?
This site is so hyper-partisan that the only question to actually seek to answer the question gets downvoted into oblivion and nominated for deletion.
The other answers - which have accrued numerous upvotes - attempt to undermine the premise of the question by:
- casting aspersions ("this confusing question"),
- arguing against assertions I never made ("no sites were agreed as 'off limits'"), and
- refuting assertions that were made with decent ex post references, by supplying ex ante references referring to inspection aspirations ("IAEA did not enter a "self-certification agreement with the Iranian authorities")
For now, I have accepted the only answer that attempts to answer the question. If another answer is provided that convincingly refutes the accepted answer and that addresses the question, I will change the accepted answer.
To restate the question as simply as I possibly can:
The stated purpose of the JCPOA is to avoid Iran militarizing nuclear technology. Given that IAEA inspectors are denied direct access to Iranian military sites, how can JCPOA compliance be monitored?
I hope this clarification helps.