Privileged Access Review Workflow
Inventory every privileged account and grant, verify continued business need with owners, and revoke the excess with an auditable trail.
Objective
Reduce standing privileged access to only what current roles require, verified by owner attestations and enforced by automated revocation.
Environment
- Access to IAM, database grants, and sudoers across the estate
- A mapping from systems to owning teams
- An approval workflow for exceptions
Steps
1. Inventory all privileged principals
Enumerate every admin-level account, role assumption, database superuser grant, and sudo rule across systems into one list.
Expected state: A single inventory exists with principal, system, grant, and last-used date.
2. Join with employment and role data
Enrich the inventory with current role, team, and employment status, flagging departed employees and role changes that outdate the grant.
Expected state: Orphaned and outdated grants are flagged mechanically rather than by memory.
3. Collect owner attestations
For each remaining grant, require the owning team to attest business need with a renewal expiry, defaulting to revoke when unattested.
Expected state: Every surviving grant carries a named attestation and an expiry date.
4. Revoke with verification
Remove unattested and flagged grants in batches, verifying afterward that legitimate access still works and nothing broke silently.
Expected state: Revocation batches complete with a post-check of critical access paths.
5. Shift standing access to just-in-time
For grants that survived review, evaluate JIT elevation (break-glass with approval and time box) so the next review starts from a smaller baseline.
Expected state: A measurable share of admin access is now temporary rather than standing.
Expected outcome
Privileged access reduced to attested, expiring grants with departed-user cleanup automated and a shrinking standing baseline.
Verification
The inventory delta shows flagged grants revoked; a test of break-glass elevation grants and expires correctly; departed users hold zero grants within a day of termination.
Cleanup
Retain attestation and revocation records for audit cycles.
Privilege accretes; reviews must decay it
Every project grants admin access that nobody remembers to remove. An inventory joined with employment data, attestations with expiry, and default-revoke for silence turns privilege from ratchet into cycle.
inventory: 312 privileged principals across 9 systems
join with HR/role data:
departed, grant active 7 -> auto-revoke
role changed, grant outdated 23 -> flag
active + plausible 282 -> attest
attestation round (2 weeks, 2 reminders):
attested w/ expiry 196 (mean expiry 90d)
unattested 86 -> REVOKE (default)
revocation batch 1 (IAM):
41 grants removed, critical paths re-tested OK
JIT migration: db superuser x 12 -> break-glass (4h window)Silence means revoke
The failure mode of access reviews is unanswered attestation requests: the deadline passes, nobody answers, and the grant survives by inertia. Defaulting unanswered to revoke (with a documented exception path) makes the review’s inertia work for security instead of against it.
Last-used data does the arguing
A grant unused for 180 days argues for its own removal better than any policy memo. Including last-used in the inventory converts review meetings from debates into confirmations, and unused-but-critical grants (break-glass) get flagged for JIT conversion rather than silent deletion.