AI System for Preparing User Access Reviews

The problem

In day-to-day operations, identity, role, application and recent-use records arrive through different systems and event records, preventing the team from seeing the case on a single timeline.

As a result, source links can be lost while the access review draft is prepared, the case can be routed to the wrong team, and the basis for the technical decision can remain unclear.

An incomplete workflow may overlook a privileged or shared account, while an incorrect system action could remove necessary access or leave excessive access in place.

What we set out to improve

• Time taken for the access review draft to be ready for specialist review
• Correct referral of records involving privileged or shared accounts to the appropriate specialist queue
• Record of recommendations corrected or rejected by the application owner

How the system works

1. 01 Retrieve identity, role, application and recent-use records from authorised sources
2. 02 Verify the source, timestamp and record identifier
3. 03 Add the relevant asset, user, shop, vehicle or content context
4. 04 Prepare the access review draft
5. 05 Compare the draft with technical rules and authority boundaries
6. 06 Check for exceptions: a privileged or shared account
7. 07 Obtain the application owner's approval, correction or rejection
8. 08 Write the input, recommendation, changes and final decision to the audit log

Methods we used

• Source- and time-traceable data extraction for identity, role, application and recent-use records
• Structured output that restricts the access review draft fields to technical rules
• An exception gate that separates privileged or shared accounts from system action
• An authorised queue that presents the evidence and recommendation together for the application owner
• Duplicate-processing controls and a rollback record to address the risk of removing necessary access or leaving excessive access in place

Where people stay involved

Data and security

Only fields required for the task are processed from identity, role, application and recent-use records. Source-system permissions are preserved, and unnecessary personal, technical and security-sensitive data is minimised before being sent to the model. Every retrieval, recommendation, human change and target-system action is written to the audit log.

Who this suits

Frequently asked questions