Run Periodic Access Reviews
Compare live grants with current job needs and record keep, narrow, remove, or hold decisions with provider evidence.
An access list is useful only while it reflects current work. Teams change roles, services change owners, and temporary grants become routine. A periodic review compares live provider grants with an approved need, then follows through on changes. OWASP's authorization guidance recommends least privilege and regular review of permissions.
Choose a review cadence based on role impact. Admin, payment, production data, and credential-issuer access may need closer review than ordinary read-only access. Include service identities as well as humans. Do not accept a spreadsheet copied from last quarter as the authoritative grant list.
Attestation worksheet
| Item | Reviewer records |
|---|---|
| Principal | Stable human or service identity |
| Provider role | Exact resource and action scope |
| Owner | Manager or service custodian |
| Current need | Job, incident, or workflow reference |
| Decision | Keep, narrow, remove, or hold |
| Deadline | Date for change and verification |
| Receipt | Provider-side status after change |
Ask reviewers to justify a keep decision, especially for broad roles. Unknown ownership is a hold with a named investigator, not automatic approval. Separate emergency access from daily permissions. A service key shared across teams cannot be attested meaningfully until callers are identified.
Verify a sample
Select one grant marked for removal in an owned system. Remove it through the provider. Confirm a denied privileged action and, if appropriate, a successful ordinary action for the same identity. For a narrowed grant, test both the retained and removed permissions. Record the actual provider event, not just a checked box.
Track unresolved grants and repeat until they have an owner or are removed. Do not publish counts as proof of security; the quality of the decisions matters. Recheck after mergers, team moves, new tooling, and incidents. Verify each removed grant at its provider, and keep the provider receipt with the review record. The review closes when decisions and verification match the live state.
Make offboarding verifiable
Use the offboarding checklist to identify owners, revoke grants and verify the result. Discuss a scoped review of your application's access controls.