it-access-reviewlisted

# Access review and joiner-mover-leaver ## Purpose Access accumulates. People change roles and keep the old entitlements, contractors finish and their accounts persist, service accounts outlive the system they were created for, and the review that is supposed to catch this becomes an exercise in managers approving lists they do not understand. This skill makes the review produce actual revocations by fixing the authoritative source, routing each item to someone who can genuinely judge it, and tracking revocations to evidence rather than to an approval click. ## Prerequisites - **Inputs:** an authoritative people list from the HR system (identity, status, manager, department, employment type, start/end dates); an entitlement export per in-scope system (account identifier, linked person, entitlement or group, last login, privileged yes/no); the previous review's outcomes. - **Access:** read on the identity provider and each in-scope system; ability to raise revocation tickets; the approver list. If the HR export and the entitlement exports cannot be joined on a common identifier, stop and fix the identifier problem first. A review run on name-matching produces false pairs and misses exactly the accounts that matter — the ones with no owner. ## Procedure 1. **Set scope by system criticality, not by convenience.** Systems handling money, personal data, production infrastructure, or the identity provider itself are in every cycle. Everything else can be annual