Access reviews are the compliance task everyone agrees is important and nobody wants to do. A spreadsheet goes out, managers tick "approve" on everything, and six months later a leaver still has admin on production.
AccessReviews is our answer: recurring review campaigns that snapshot the access in scope, route each item to the right reviewer with the context they need, and then follow every revoke through to the moment the access is actually gone.
The problem we started from
The failure mode is not that people refuse to review. It is that the review arrives without context — a list of entitlement names with no hint of which ones matter — and with nothing behind it: a "revoke" is a note in a spreadsheet, not a task with an owner.
A review is only as good as the follow-through. If the revoke never lands, the review was theatre.
Campaigns
A campaign has a kind (user access, privileged access, application recertification, leaver sweep), a scope (applications, departments, entitlement kinds, privileged-only, contractors-only, include leavers), a reviewer strategy (line manager, application owner or a named person), a due date, a reminder cadence and a close policy. On launch it snapshots every matching assignment into review items — one row per person per entitlement — and assigns a reviewer to each.
Applications, departments, kinds and who reviews.
Assignments become items; reviewers get a queue.
Every decision carries a justification.
Summary, per-item CSV and remediation tasks.
Flags and guidance
Every item carries computed risk flags — privileged, leaver, suspended, dormant for 90+ days, contractor, high-risk entitlement, no manager — and each flag comes with a line of reviewer guidance. A manager looking at "Okta Super Admin · dormant 120 days · contractor" does not need a policy document to know what to do.
Context on the row
Application criticality, last use, who granted it and when.
Bulk with care
Decide many items at once, but the justification is required and stored per item.
Reminders and escalation
Reviewers behind the cadence are reminded; overdue ones are escalated and visible on the campaign.
Decisions that go somewhere
Approve is approve. Revoke opens a remediation task at close, assigned to the application owner, and tracked from open → in progress → completed → verified — verified meaning the live assignment is actually gone. Exception is a time-boxed approval with an expiry date; expired exceptions are swept and surfaced so nothing quietly becomes permanent.
Evidence
Each campaign closes with a summary (decision mix, flags, applications, departments, reviewer progress, median time to decide, reminders sent, remediation status) and a one-row-per-item evidence.csv an auditor can read without a walkthrough.
How it is built
Go backend (standard-library routing, SQLite, table-driven tests covering the lifecycle, decisions, exceptions, remediation and evidence) and a Next.js 16 / React 19 frontend on shadcn/ui and Tailwind v4 in the System32 theme. Screens: dashboard, campaigns (overview, items, remediation, evidence, activity), the reviewer's queue, identities, applications, exceptions, remediation board and the audit trail. Sign-in goes through the System32 control plane.
AccessReviews is available now. Ask us for a workspace seeded with a realistic identity estate and run your first campaign in an afternoon.