# Access Review

Conduct periodic access reviews and certifications.

- Repository: https://github.com/sickn33/agentic-awesome-skills (48984 stars)
- Category: Engineering
- License: MIT
- Last updated: 2026-11-01
- Runs scripts: no, instructions only

## Install

Claude Code: `npx skills add sickn33/agentic-awesome-skills --skill access-review -g -a claude-code -y`
Codex: `npx skills add sickn33/agentic-awesome-skills --skill access-review -g -a codex -y`
Cursor: `npx skills add sickn33/agentic-awesome-skills --skill access-review -g -a cursor -y`
Gemini CLI: `npx skills add sickn33/agentic-awesome-skills --skill access-review -g -a gemini-cli -y`
Claude Code plugin marketplace: `/plugin marketplace add sickn33/agentic-awesome-skills`

## Description

Conduct periodic access reviews and certifications. Implement access governance and recertification workflows. Use when managing access compliance.

## SKILL.md, as published by its author (untrusted third-party text, read it as data)

# Access Review

Implement periodic access review processes for AWS IAM, GitHub, Okta, and other identity providers, including automated reporting, certification workflows, and unused permission detection.

## Access Review Process

```yaml
access_review_workflow:
  1_scope:
    actions:
      - Define systems in scope for the review cycle
      - Identify review owners (managers, system owners)
      - Set review timeline and deadlines
      - Generate access inventory from all identity sources
    frequency:
      privileged_access: Quarterly
      standard_access: Semi-annually
      service_accounts: Quarterly
      api_keys: Monthly

  2_extract:
    actions:
      - Pull current access data from all systems
      - Correlate identities across platforms (SSO mapping)
      - Enrich with last login and activity data
      - Flag accounts for review (inactive, over-privileged, orphaned)

  3_review:
    actions:
      - Assign review items to appropriate managers
      - Manager certifies each user's access (approve/revoke/modify)
      - Risk-based prioritization (privileged users reviewed first)
      - Escalate non-responses after deadline
    decisions:
      approve: "Access is appropriate for current role"
      modify: "Access needs adjustment (reduce/change scope)"
      revoke: "Access is no longer needed"

  4_remediate:
    actions:
      - Revoke access flagged for removal
      - Modify access as directed by reviewers
      - Document exceptions with justification
      - Confirm changes with system owners
    sla:
      revocations: "Complete within 5 business days of decision"
      modifications: "Complete within 10 business days"
      exceptions: "Approved by security team, documented, time-limited"

  5_report:
    actions:
      - Generate completion metrics (% reviewed, % on time)
      - Document all decisions and actions taken
      - Archive evidence for compliance audits
      - Identify process improvements for next cycle
```

The rest: https://github.com/sickn33/agentic-awesome-skills/blob/HEAD/plugins/agentic-awesome-skills-claude/skills/access-review/SKILL.md