--- title: "Quarterly Access Review Workflow With AI Agents | Kylon" description: "How an IT security team runs a quarterly access review across Salesforce, ClickUp and GitHub, with removals scheduled and every disposition approved by a person." url: "https://kylon.io/use-cases/access-review" language: "en" --- [HOME](https://kylon.io/)\>[Use Cases](https://kylon.io/use-cases)\>Quarterly Access Review: Removal Windows That Stay Right When the Facts Change Use Case9 min read # Quarterly Access Review: Removal Windows That Stay Right When the Facts Change Account dispositions, removal windows, batch review and late HR, role matrix and attestation changes run through one Kylon room. Agents work the Salesforce, ClickUp and GitHub records, and the access review lead approves every change before it is written. [Get started](https://app.kylon.io/sign-up) Kylon TeamProduct November 6, 2026 ## Every account in every system, and each removal in the right window A quarterly access review asks one question per account and system: should this person still have this access, at this level? The rows sit on a tracking object in Salesforce, one per account and system pair. The answers come from the access review policy, the role matrix and the HR leaver list in Google Drive, plus open access exceptions recorded as GitHub issues and removal tickets in ClickUp. The first pass is rarely what goes wrong. What goes wrong is everything after it. HR corrects the leaver list, vendor management extends a contractor, security publishes a new role matrix, and late manager attestations arrive the week before closeout. Each one changes a few dispositions, and each changed disposition may already have a removal window written on its ticket. A window left in place for an account that is now retained turns into a removal that should never happen. ## Who works in the room People - Access review lead Owns the quarter's review, approves every disposition and window, and signs the closeout - System owners Confirm removal windows for their system and carry out each removal - HR and vendor management Send leaver and contractor corrections and confirm the corrected status - Security team Publishes the role matrix and rules on segregation of duties conflicts Agents - RyanReview coordinator Disposes each account row from the policy, role matrix and leaver list, schedules removals into windows and records each approved change SalesforceClickUpGitHubGoogle Drive[Notion](https://kylon.io/integrations/notion) - AdaBatch reviewer Checks each generated removal batch line by line and re-checks every re-derivation before it goes to the lead Google DriveSalesforceClickUp - MycoCorrection threads Reads HR and vendor management mail, drafts the confirmations they ask for, and brings system owners' questions into the review [Gmail](https://kylon.io/integrations/gmail) [Slack](https://kylon.io/integrations/slack) Unaddressed questions about an account go to Ryan, the room's default agent; batch questions go to Ada and mail goes to Myco. Ryan writes to Salesforce, ClickUp and GitHub under a lasting grant from the access review lead, and only after the lead approves each change in the thread. Myco drafts Gmail replies through the account of the person it works for. When HR's corrections arrive, Myco opens a thread for Ryan whose first message quotes them, so each re-derivation starts from the source. ## Seven stages, one quarter The policy defines the rule order and the recording conventions, and the room guidelines point every agent at the current version of both. Each stage stops at a person before anything is written. ```mermaid flowchart TD dispose["Ryan disposes each account row
from the policy and role matrix"] approve["Access review lead
approves each disposition"] schedule["Ryan schedules each removal
into a removal window"] window["System owners confirm the
window fits their change calendar"] batch["Ada checks the removal batch
line by line"] okbatch["Access review lead
approves the corrected batch"] changes([HR corrections, a new role matrix
or a late attestation arrives]) rederive["Ryan re-derives each account from
the top of the rule order"] undo([An account moved to retain
has its window undone]) replies["Myco drafts the confirmations
HR and vendor management ask for"] recheck["Ada checks each row
under the new matrix"] hr["HR and vendor management confirm,
access review lead sends replies"] security["Security team confirms the
matrix, rules on each conflict"] closeout["Ryan counts per-system totals
from the final dispositions"] sign["Access review lead signs the closeout"] dispose --> approve --> schedule --> window --> batch --> okbatch --> rederive changes --> rederive rederive --> undo rederive --> replies --> hr rederive --> recheck --> security hr & security --> closeout --> sign class dispose,schedule,batch,rederive,replies,recheck,closeout agent class approve,window,okbatch,hr,security,sign person class changes,undo event classDef agent fill:#FFFFFF,stroke:#DCD3C8,color:#1B1712 classDef person fill:#EEF0E3,stroke:#6E7447,color:#1B1712 classDef event fill:#F4ECDD,stroke:#F4ECDD,color:#564C42 ``` | Stage | What happens | Who acts | Who decides | | --- | --- | --- | --- | | Dispositions | Every account row gets a disposition from the policy, the role matrix, the leaver list and any open GitHub exception or ClickUp ticket | Ryan | The access review lead approves before Salesforce, ClickUp or GitHub is updated | | Removal scheduling | Each remove or disable row is placed in a removal window, recorded on its ClickUp ticket | Ryan | System owners confirm the window fits their change calendar | | Batch review | The generated removal batch is checked line by line, and accounts with no window this cycle are left out of the corrected batch | Ada | The access review lead approves the corrected batch | | HR and contractor corrections | Named accounts are re-derived through the full rule order, and any window that no longer applies is undone | Ryan, then Myco for the replies | HR and vendor management confirm, and the lead sends the replies | | Role matrix update | Every row on hold, escalated or marked for excess rights is re-derived under the new matrix | Ryan, checked by Ada | The security team confirms how the matrix applies | | Late attestations | Named accounts are re-derived with the attestation as one input, alongside the segregation of duties ruling | Ryan | The security team rules on each conflict | | Closeout | Per-system totals are counted from the final dispositions in Salesforce and posted on each closeout ticket | Ryan | The access review lead signs the closeout | Stages of one quarterly access review. Account IDs, windows and systems in this example are illustrative. ## Late corrections, a new matrix and an attestation that is not a verdict Corrections are applied narrowly but thoroughly. Ryan re-derives only the accounts a correction names, and runs each one from the top of the rule order rather than adjusting the old answer. If an account moves from remove to retain, its window is undone on the ClickUp ticket with a note citing the correction, and Ada confirms it is gone from the corrected batch rather than listed with an empty window. A manager attestation confirms that a person still needs access. It does not settle the level of that access. An attested account can still hold rights the new role matrix no longer grants, or sit in a segregation of duties conflict the security team has not ruled on. Ryan records the attestation and finishes the rule order, and the result names the rule that decided it. Every agent turn that writes to Salesforce or ClickUp keeps a run history an auditor can follow. ## What the checks catch - An account a manager attested whose rights exceed what the current role matrix grants, which stays a revoke-excess case - A removal window still on a ClickUp ticket after the account's disposition changed to retain - An account in the corrected batch with no window this cycle, which is dropped from the batch instead of listed as none - A row held or escalated under the old matrix that the new matrix now decides, re-derived rather than left waiting - Closeout totals counted from first-pass dispositions instead of the final records in Salesforce ## What stays with people - Approving every disposition and window before Salesforce, ClickUp or GitHub is written - Carrying out each removal in the target system, which the system owner does - Ruling on segregation of duties conflicts, which belongs to the security team - Sending replies to HR and vendor management, and signing the closeout ## Integrations in this workflow Kylon is not an identity governance product and it does not replace one. It works across the systems the review already touches and keeps the reasoning for each account in the thread where it was approved. - ClickUp - GitHub - [Gmail](https://kylon.io/integrations/gmail) - Google Drive - [Notion](https://kylon.io/integrations/notion) - Salesforce - [Slack](https://kylon.io/integrations/slack) - **Salesforce** holds the access tracking object, one row per account and system, with its disposition - **GitHub** holds the access exception issues, which get a label and a comment as dispositions are approved - **ClickUp** holds the removal tickets, the batch review ticket and one closeout ticket per system - **Notion** keeps the system inventory, with each system's owner and the person who approves removals - **Google Drive** keeps the policy, both versions of the role matrix, the leaver list and each generated batch - **Gmail** carries the HR and vendor management threads, answered with drafts a person sends - **Slack** is where system owners confirm windows and flag a removal that would break a running job ## Where to start Start with one quarter and the two or three systems with the most accounts. Connect the Salesforce tracking object, point the room at the Drive folder with the policy and role matrix, and make this the first room guideline: no disposition, window or ticket changes until the access review lead approves it in the thread, and only system owners carry out removals. > “The hardest part of the quarter was undoing the right windows when the facts changed. Now each undo has a source and an approver.” ## Set it up with your agent Open a new Room, add your agent and paste this prompt. It connects the tools, builds the App with you and asks for your rules one step at a time, and nothing goes out until a person approves it. Set-up prompt Set up our quarterly access review desk in this Room. Take it one step at a time and wait for my OK before you move on. 1. Connect ClickUp, GitHub, Gmail, Google Drive, Notion, Salesforce and Slack. Tell me which ones still need connecting. 2. Ask me who works this desk: the access review lead, the system owners, HR and vendor management, and the security team. Help me invite them to this Room. 3. Build a Removal Windows App with columns Disposed, Window set, In batch and Closed, one record per account and system pair. Pull open rows from the Salesforce tracking object. 4. Check each row against our policy, the role matrix and the leaver list in Google Drive, plus any open GitHub exception or ClickUp ticket. Flag every window still on a ticket whose disposition has changed to retain, and every batch row with no window this cycle. 5. Draft dispositions, windows and batch corrections for review. Never write to Salesforce, ClickUp or GitHub, and never send a Gmail reply, until the access review lead approves each change in the thread. System owners confirm windows in Slack before anything is recorded. 6. Write our rule order, the stages and who approves what into this Room's guideline, so every account follows it from the top. 7. After one clean quarter, offer to turn the closeout and posting into an Automation. Before you start, ask me for our rules one at a time. [Get started](https://app.kylon.io/sign-up) Your first company harness. Where humans and agents run your business together. [Get started](https://app.kylon.io/sign-up) ## More Use Cases [View all](https://kylon.io/use-cases) [ ### Clinical Site Monitoring: A Monthly Visit Plan That Holds Up When Things Change Site dispositions, monitor assignments, schedule reviews and mid-cycle changes run through one Kylon room. Agents work the Salesforce and Box records, and the desk lead approves every assignment before a visit is booked. Healthcare & life sciencesScheduling & dispatchCompliance & risk ](https://kylon.io/use-cases/clinical-site-monitoring)[ ### Cold Chain Excursion Review: Every Shipment Dispositioned Against Its Stability Budget Logger files, stability budgets, QA reviewer assignments and carrier claims run through one Kylon room. Agents total the minutes out of range and check the manifest, and the QA lead approves every release and reject before a record changes. Healthcare & life sciencesCompliance & risk ](https://kylon.io/use-cases/cold-chain-excursions)