access-lifecycle

Topics in the source

• Access Lifecycle
• Workflow
• The gates block on (exit 4)
• Hard rules
• Scripts
• References and assets

Portability: 3 stdlib scripts, no network, no IdP or HR connection. Export CSV, run, keep the output as evidence. Not audit advice. Periods and thresholds are your policy; the scripts make you state them. Access reviews fail audits in four ordinary ways: the review ran on an incomplete export, someone approved their own access, a revoke was decided and never carried out, and leavers kept working accounts nobody looked at. Each script catches one class of these before the auditor does. Step 1 joins each account to the roster on employee ID, then email. A terminated person with an enabled account is a blocker; one who logged in after their exit date is a worse one. Accounts that match nobody are orphans; service accounts need a named owner. Inactivity and privileged-review age use your periods. Step 2 checks the campaign against the export it was built from. An enabled account missing from the campaign means the review did not cover the population, whatever the sign-off sheet says. It also catches undecided lines, self-review, revokes not removed inside your window, late decisions, and a reviewer who kept every line of a large batch at machine speed. Step 3 turns findings into a per-

This is an excerpt. Refer to the complete source and its current requirements.