The task
An access review is an evidence-gathering exercise dressed as a security control. Configure an agent to assemble the exports and approvals a system owner needs and to name the accounts that nothing explains, so the reviewer starts at the accounts that matter instead of scrolling a spreadsheet.
What you provide
Account and entitlement exports
Current accounts per system with their entitlements and last activity, exported for the review period.
Approval records
The access requests and approvals that authorized those entitlements, however they are recorded.
Joiner and leaver records
Start dates, role changes and departures for the period, so an account can be tested against employment status.
Give the agent a clear brief
Use these instructions as a starting point, alongside your approved sources and permissions.
For each account, find the approval that authorized its entitlements and cite the record. Report an account as unexplained when no approval covers it, and as a departure exception when the holder has left. Separate dormant accounts from unapproved ones. Do not disable an account, revoke an entitlement or change any permission.
How the work comes together
Join the records
Line accounts up against approvals and employment records. Identifiers rarely agree across systems, and an unmatched identifier is reported rather than assumed to be a new person.
Test against employment
Check each account holder against the leaver records. An active account belonging to someone who left is the finding a review exists to produce.
Produce the reviewer pack
Return the unexplained accounts, departure exceptions and dormant accounts as separate lists with their evidence, ready for the system owner to certify.
Illustrative example · fictional data
The accounts a reviewer should start with
An illustrative pack for a fictional system, covering one review period with approvals held in a request tool.
| Account | Evidence found | For the reviewer |
|---|---|---|
| Standard user, 412 accounts | Approval record for each entitlement | Explained, certify in bulk |
| Elevated access, 1 account | No approval record found | Unexplained, needs an answer |
| Active account, holder departed | Leaver record dated last month | Departure exception, urgent |
The value is the second and third rows. Anything that reduces 414 accounts to two questions has done the work a review is for.
The human review
The system owner certifies the review and decides what is revoked. The agent never changes an entitlement; revocation runs through your identity process with its own approval and audit trail.
Set it up for your team
Agree how identities are joined
Supply the mapping between account identifiers and employee records. Most of the effort in a real access review is this join, and guessing it produces confident nonsense.
Point at where approvals live
Approvals are often in a ticket tool, an email thread or a spreadsheet. An approval source that is not supplied becomes an unexplained account.
Keep revocation out of scope
Configure the playbook to produce evidence only. Automated revocation is a separate, higher-risk change with its own controls.
Check the result before scaling
Rebuild a completed review and compare. Count accounts wrongly marked explained, and check that every citation leads to an approval record a reviewer can open.
Keep the data in the right place
An access review pack is a map of who can reach what, which makes it valuable to an attacker. A fully local deployment keeps account exports and the resulting pack inside your network.
Explore deployment optionsQuestions & answers
Can it revoke access it finds unexplained?
No, and that is deliberate. It produces evidence for a human certification; revocation runs through your identity process with its own approvals.
What if account names do not match employee records?
Supply the mapping rules. Unmatched identifiers are reported as unmatched, because a wrong join is worse than an unresolved one in a control this sensitive.
Is a dormant account the same as an unapproved one?
No, and they are returned as separate lists. One is a hygiene question and the other is a control failure.