Access reviews
Create immutable grant snapshots and retain or revoke access before a fail-closed deadline.
Access-review campaigns recertify active grants.
Create a campaign
In Access, an owner or admin:
- Chooses Create access-review campaign.
- Enters a name and evidence context.
- Names one to 64 reviewer actor IDs.
- Sets a due date between the supported minimum and 90 days.
- Creates the immutable snapshot.
The campaign captures each active grant as it exists at creation time.
Review an item
A named reviewer examines the subject, target, local username, grant window, and evidence, then selects:
- Retain to keep the grant; or
- Revoke to contain it.
Every decision requires a reason, confirmation, and recent MFA. Reviewers cannot decide their own grant.
Due-time behavior
Undecided grants are revoked when the campaign reaches its due time. This fail-closed behavior prevents an incomplete campaign from silently retaining access.
Evidence
Retain the campaign ID, due time, immutable item count, reviewer set, decisions, and resulting revocations with the audit export for the review period.