Remove Stale Admin Grants
Find administrator grants with no current job need, remove them at the provider, and prove normal access still works.
Admin grants tend to outlive projects, on-call rotations, and team moves. A stale grant may still work even when the application UI no longer lists the person as an administrator. Review the authoritative provider or identity system, not only a local roster.
Define a current need for each privileged role. OWASP's authorization guidance recommends least privilege and periodic review. A grant with no named owner or no recent justified use is a candidate for removal, but a lack of activity alone does not prove it is safe to delete during a critical operation.
Review sheet
| Grant | Evidence needed |
|---|---|
| Principal | Human or service identity, not a display name alone |
| Provider role | Exact permissions and resource scope |
| Business owner | Person who can confirm the need |
| Last justified use | Change ticket or incident reference |
| Decision | Keep, narrow, remove, or hold |
| Removal proof | Provider-side status and denied test |
| Continuity | Expected ordinary task still works |
Separate emergency accounts from routine admin grants. If a service account has an admin role because the provider lacks finer controls, record that constraint and a mitigation plan. Do not transfer a human's admin credential to a bot to preserve access.
Verify removal
Use a test account or a safe provider permission check. Remove one stale grant through the authorized operator path. Confirm the provider no longer lists the role, an old session cannot perform the admin action under the team's session model, and the person's ordinary non-admin task still works if appropriate. Check queued jobs or cached permissions that may survive the change.
Record the decision time, approver, provider event ID, and any propagation delay. Do not store session tokens in the worksheet. If a removal breaks a required task, restore access through a fresh reviewed grant with the smallest scope rather than silently restoring the broad old role. Repeat the review after team moves, incidents, and major provider changes. The goal is a current privilege map, not a one-time cleanup count.
Make offboarding verifiable
Use the offboarding checklist to identify owners, revoke grants and verify the result. Discuss a scoped review of your application's access controls.