Access reviews and audit

Access reviews and audit show which grants were reviewed and what happened to them. Governance & Administration owns these checks and the Audit Log.

Ownership

An Access Review checks standing Group membership, Role holdings, or Purpose grants. Each campaign names the access kind, due date, and lapse policy. Open Access Reviews at /governance/access-reviews for the review queue. Open Audit Log at /governance/audit to inspect events and Role history. Run lineage stays with the Capability that produced the Run.

Lifecycle

A recertification campaign creates review items from standing access. Each pending item accepts Keep, Revoke, or Defer and records the reviewer. At completion, still-pending items lapse. The campaign's lapse policy either removes their access or escalates them. Closing before the due date is refused through the standard completion path.

The review decision records an attestation. It does not itself remove the grant. A Revoke decision therefore needs separate grant removal and readback. For lapsed items, automatic removal covers Group, Role, and Purpose grants. A failed removal remains tracked as pending or failed work. Campaign closure alone does not prove every grant was removed.

Boundaries

The Audit Log offers a filtered event view and CSV export. An empty view only means no returned events match the query. A review item, Role grant, and writeback request each retain their own state. Use that state to verify the effect. Work Activity provides a work history view. It does not replace an access review or its evidence.

Credential material never enters the access decision audit rows. Credential use needs its start audit entry to land before the external effect proceeds. If that entry cannot be written, the effect is refused. Later outcome evidence can arrive separately. Use the original request's readback to verify the result when the audit view is incomplete.

API keys are created and revoked in the Console at /settings/developers. A key belongs to the signed-in user and carries selected scopes. Creation shows its secret once. Later lists show its prefix and use history. Revoke a key when its use ends. The API access guide owns authentication and Workspace selection for calls made with it.

Failures

An Access Review cannot decide an item that was already reviewed. A repeated campaign start can recover the open campaign, but changed cadence or lapse policy is refused. An audit query failure is not an empty result. An absent API key needs a check of the signed-in user and key identity before another revoke attempt.

Recovery

Refresh the Access Review item before deciding it again. The review contract owns the call and its errors. Check the underlying grant after a removal decision and resolve any outstanding lapse work. For a lost start response, recover the same campaign through the campaign start contract, then inspect its items.

The access workflow checks grants, refusals, and writeback repair against their resulting state.
The Role model explains what expires or is revoked when a review requires access to end.