Quarterly Access Review: Removal Windows That Stay Right When the Facts Change
Account dispositions, removal windows, batch review and late HR, role matrix and attestation changes run through one Kylon room. Agents work the Salesforce, ClickUp and GitHub records, and the access review lead approves every change before it is written.
Every account in every system, and each removal in the right window
A quarterly access review asks one question per account and system: should this person still have this access, at this level? The rows sit on a tracking object in Salesforce, one per account and system pair. The answers come from the access review policy, the role matrix and the HR leaver list in Google Drive, plus open access exceptions recorded as GitHub issues and removal tickets in ClickUp.
The first pass is rarely what goes wrong. What goes wrong is everything after it. HR corrects the leaver list, vendor management extends a contractor, security publishes a new role matrix, and late manager attestations arrive the week before closeout. Each one changes a few dispositions, and each changed disposition may already have a removal window written on its ticket. A window left in place for an account that is now retained turns into a removal that should never happen.
Who works in the room
People
Access review lead
Owns the quarter's review, approves every disposition and window, and signs the closeout
System owners
Confirm removal windows for their system and carry out each removal
HR and vendor management
Send leaver and contractor corrections and confirm the corrected status
Security team
Publishes the role matrix and rules on segregation of duties conflicts
Agents
RyanReview coordinator
Disposes each account row from the policy, role matrix and leaver list, schedules removals into windows and records each approved change
AdaBatch reviewer
Checks each generated removal batch line by line and re-checks every re-derivation before it goes to the lead
Google Drive
Salesforce
ClickUp
MycoCorrection threads
Reads HR and vendor management mail, drafts the confirmations they ask for, and brings system owners' questions into the review
Unaddressed questions about an account go to Ryan, the room's default agent; batch questions go to Ada and mail goes to Myco. Ryan writes to Salesforce, ClickUp and GitHub under a lasting grant from the access review lead, and only after the lead approves each change in the thread. Myco drafts Gmail replies through the account of the person it works for. When HR's corrections arrive, Myco opens a thread for Ryan whose first message quotes them, so each re-derivation starts from the source.
Seven stages, one quarter
The policy defines the rule order and the recording conventions, and the room guidelines point every agent at the current version of both. Each stage stops at a person before anything is written.
- Agent works
- Person decides
- Arrives or gets recorded
flowchart TD
dispose["<b>Ryan</b> disposes each account row<br>from the policy and role matrix"]
approve["<b>Access review lead</b><br>approves each disposition"]
schedule["<b>Ryan</b> schedules each removal<br>into a removal window"]
window["<b>System owners</b> confirm the<br>window fits their change calendar"]
batch["<b>Ada</b> checks the removal batch<br>line by line"]
okbatch["<b>Access review lead</b><br>approves the corrected batch"]
changes([HR corrections, a new role matrix<br>or a late attestation arrives])
rederive["<b>Ryan</b> re-derives each account from<br>the top of the rule order"]
undo([An account moved to retain<br>has its window undone])
replies["<b>Myco</b> drafts the confirmations<br>HR and vendor management ask for"]
recheck["<b>Ada</b> checks each row<br>under the new matrix"]
hr["<b>HR and vendor management</b> confirm,<br><b>access review lead</b> sends replies"]
security["<b>Security team</b> confirms the<br>matrix, rules on each conflict"]
closeout["<b>Ryan</b> counts per-system totals<br>from the final dispositions"]
sign["<b>Access review lead</b> signs the closeout"]
dispose --> approve --> schedule --> window --> batch --> okbatch --> rederive
changes --> rederive
rederive --> undo
rederive --> replies --> hr
rederive --> recheck --> security
hr & security --> closeout --> sign
class dispose,schedule,batch,rederive,replies,recheck,closeout agent
class approve,window,okbatch,hr,security,sign person
class changes,undo event
classDef agent fill:#FFFFFF,stroke:#DCD3C8,color:#1B1712
classDef person fill:#EEF0E3,stroke:#6E7447,color:#1B1712
classDef event fill:#F4ECDD,stroke:#F4ECDD,color:#564C42| Stage | What happens | Who acts | Who decides |
|---|---|---|---|
| Dispositions | Every account row gets a disposition from the policy, the role matrix, the leaver list and any open GitHub exception or ClickUp ticket | Ryan | The access review lead approves before Salesforce, ClickUp or GitHub is updated |
| Removal scheduling | Each remove or disable row is placed in a removal window, recorded on its ClickUp ticket | Ryan | System owners confirm the window fits their change calendar |
| Batch review | The generated removal batch is checked line by line, and accounts with no window this cycle are left out of the corrected batch | Ada | The access review lead approves the corrected batch |
| HR and contractor corrections | Named accounts are re-derived through the full rule order, and any window that no longer applies is undone | Ryan, then Myco for the replies | HR and vendor management confirm, and the lead sends the replies |
| Role matrix update | Every row on hold, escalated or marked for excess rights is re-derived under the new matrix | Ryan, checked by Ada | The security team confirms how the matrix applies |
| Late attestations | Named accounts are re-derived with the attestation as one input, alongside the segregation of duties ruling | Ryan | The security team rules on each conflict |
| Closeout | Per-system totals are counted from the final dispositions in Salesforce and posted on each closeout ticket | Ryan | The access review lead signs the closeout |
Late corrections, a new matrix and an attestation that is not a verdict
Corrections are applied narrowly but thoroughly. Ryan re-derives only the accounts a correction names, and runs each one from the top of the rule order rather than adjusting the old answer. If an account moves from remove to retain, its window is undone on the ClickUp ticket with a note citing the correction, and Ada confirms it is gone from the corrected batch rather than listed with an empty window.
A manager attestation confirms that a person still needs access. It does not settle the level of that access. An attested account can still hold rights the new role matrix no longer grants, or sit in a segregation of duties conflict the security team has not ruled on. Ryan records the attestation and finishes the rule order, and the result names the rule that decided it. Every agent turn that writes to Salesforce or ClickUp keeps a run history an auditor can follow.
What the checks catch
- An account a manager attested whose rights exceed what the current role matrix grants, which stays a revoke-excess case
- A removal window still on a ClickUp ticket after the account's disposition changed to retain
- An account in the corrected batch with no window this cycle, which is dropped from the batch instead of listed as none
- A row held or escalated under the old matrix that the new matrix now decides, re-derived rather than left waiting
- Closeout totals counted from first-pass dispositions instead of the final records in Salesforce
What stays with people
- Approving every disposition and window before Salesforce, ClickUp or GitHub is written
- Carrying out each removal in the target system, which the system owner does
- Ruling on segregation of duties conflicts, which belongs to the security team
- Sending replies to HR and vendor management, and signing the closeout
Integrations in this workflow
Kylon is not an identity governance product and it does not replace one. It works across the systems the review already touches and keeps the reasoning for each account in the thread where it was approved.
- Salesforce holds the access tracking object, one row per account and system, with its disposition
- GitHub holds the access exception issues, which get a label and a comment as dispositions are approved
- ClickUp holds the removal tickets, the batch review ticket and one closeout ticket per system
- Notion keeps the system inventory, with each system's owner and the person who approves removals
- Google Drive keeps the policy, both versions of the role matrix, the leaver list and each generated batch
- Gmail carries the HR and vendor management threads, answered with drafts a person sends
- Slack is where system owners confirm windows and flag a removal that would break a running job
Where to start
Start with one quarter and the two or three systems with the most accounts. Connect the Salesforce tracking object, point the room at the Drive folder with the policy and role matrix, and make this the first room guideline: no disposition, window or ticket changes until the access review lead approves it in the thread, and only system owners carry out removals.
“The hardest part of the quarter was undoing the right windows when the facts changed. Now each undo has a source and an approver.”
Set it up with your agent
Open a new Room, add your agent and paste this prompt. It connects the tools, builds the App with you and asks for your rules one step at a time, and nothing goes out until a person approves it.
Set up our quarterly access review desk in this Room. Take it one step at a time and wait for my OK before you move on. 1. Connect ClickUp, GitHub, Gmail, Google Drive, Notion, Salesforce and Slack. Tell me which ones still need connecting. 2. Ask me who works this desk: the access review lead, the system owners, HR and vendor management, and the security team. Help me invite them to this Room. 3. Build a Removal Windows App with columns Disposed, Window set, In batch and Closed, one record per account and system pair. Pull open rows from the Salesforce tracking object. 4. Check each row against our policy, the role matrix and the leaver list in Google Drive, plus any open GitHub exception or ClickUp ticket. Flag every window still on a ticket whose disposition has changed to retain, and every batch row with no window this cycle. 5. Draft dispositions, windows and batch corrections for review. Never write to Salesforce, ClickUp or GitHub, and never send a Gmail reply, until the access review lead approves each change in the thread. System owners confirm windows in Slack before anything is recorded. 6. Write our rule order, the stages and who approves what into this Room's guideline, so every account follows it from the top. 7. After one clean quarter, offer to turn the closeout and posting into an Automation. Before you start, ask me for our rules one at a time.
Your first company harness. Where humans and agents run your business together.
More Use Cases
View allClinical Site Monitoring: A Monthly Visit Plan That Holds Up When Things Change
Site dispositions, monitor assignments, schedule reviews and mid-cycle changes run through one Kylon room. Agents work the Salesforce and Box records, and the desk lead approves every assignment before a visit is booked.
Cold Chain Excursion Review: Every Shipment Dispositioned Against Its Stability Budget
Logger files, stability budgets, QA reviewer assignments and carrier claims run through one Kylon room. Agents total the minutes out of range and check the manifest, and the QA lead approves every release and reject before a record changes.