Access reviews · Decision guide
Multi-workflowIT and securityUser access reviews: spreadsheet, scheduled workflow or continuous checks
Access reviews fail in the same way everywhere: managers approve long lists they cannot judge. This guide compares three ways to run them and when each one fits.
Valnora & Elric team5 min read
Compared in this guide
- ASpreadsheet campaign
- BScheduled workflow
- CContinuous checks + workflow
Every access review has the same weak point. A manager receives a list of a few hundred entitlements, most with names that mean nothing outside IT, and is asked to confirm each one is still needed. With no way to tell which items matter, they approve the lot. The review is complete on paper and has removed almost nothing.
Most frameworks expect these reviews. PCI DSS includes access-control requirements that call for periodic reviews of user access, for example, and NIST SP 800-53 covers account management in its access control family. The question is not whether to run them but how to make them mean something. This guide compares three approaches.
The three options side by side
Three ways to run user access reviews
| Criterion | Spreadsheet campaign | Scheduled workflow | Continuous checks + workflow |
|---|---|---|---|
| How it works | Export accounts, email a sheet to each manager, chase replies, collect signatures. | Workflows collect access, pre-check it and ask each manager to certify in a Human block. | The same workflows, plus weekly checks between cycles that flag risky access as it appears. |
| Effort per cycle | High. Most time goes on building sheets and chasing. | Low after setup. Chasing is a monitor and a reminder. | Low per cycle, with a small weekly triage of new flags. |
| What managers see | Every entitlement, unexplained. | Flagged items first, with a reason for each. | A shorter list, because many issues were fixed between cycles. |
| Evidence for auditors | Signed sheets and email threads, assembled after the fact. | Decisions in a table, each workflow run in Logs. | Same, plus a record of when each risky access was found and removed. |
| Catches problems between cycles | No. | No. | Yes. Leavers and conflicting roles are flagged within a week. |
| Best fit | Few systems, few people, one annual review. | Several systems and regular review cycles. | Regulated environments, privileged access and many movers. |
When a spreadsheet campaign is enough
A spreadsheet is the right tool when the scope is small: a handful of systems, a few dozen people, one review a year, and an auditor who accepts signed sheets. Building workflows for that would cost more than it saves.
The warning signs that you have outgrown it are easy to spot. The campaign takes longer to prepare than to run. Managers ask what a role means. The same leaver shows up with live access two cycles running. Evidence is assembled from email threads the week before the audit.
When to use scheduled review workflows
Once several systems are in scope and reviews run quarterly or twice a year, the work worth automating is everything around the decision. Three workflows built in the workflow builder cover it.
- Collect. On a schedule, API and database blocks read accounts and roles from your identity provider and in-scope applications, and join them to the HR feed. The result is one entitlements table in Tables, with owner, manager and last login for each row.
- Pre-review. Rules flag what your policy names: leavers or movers with old access, accounts unused past your dormancy limit, and pairs of roles that should not be held together. An Agent block then writes a short summary for each manager, like the example below, so flagged items come first with a plain reason.
- Certify. A Human block asks each manager to keep or remove each flagged item and to confirm the rest as a group. Decisions are written to the table with the manager’s name and time. Removals open a ticket through the ServiceNow block, so IT makes the change in the system itself and the workflow keeps the ticket number.
What the solution produces
Reviewer summary for one manager (illustrative)
MemoYou are asked to review 46 entitlements across 9 people. 41 are unchanged since the last review and have no flags.
Flagged: one person moved from Payments Operations to Treasury in July and still holds the payment release role.
Flagged: two accounts in the general ledger system have not been used for over 90 days.
Flagged: one person holds both the create vendor and approve payment roles, a conflicting pair in your policy.
Please confirm keep or remove for the four flagged items. Unflagged items can be confirmed as a group.
The workflow does not remove access directly. That is a deliberate choice. Removal belongs in the system of record, done by the team that owns it, with its own change trail.
When to add continuous checks
The third option keeps the same workflows and runs the collect and pre-review steps weekly, between certification cycles. New flags go to the system owner straight away rather than waiting months for the next campaign.
Three workflows behind a reviewable access campaign
Workflow 1 · Collect
- 01ScheduleRuns weekly for continuous checks, or at the start of each review cycle.
- 02Accounts and rolesAPI and database blocks read accounts and entitlements from your identity provider and key apps.
- 03HR feedJoiners, movers and leavers, with manager and department, from your HR system.
- 04Entitlements tableOne row per person, system and role, with last login and owner.
Workflow 2 · Pre-review
- 05Access checksRules flag leavers with live accounts, dormant access and conflicting role pairs.
- 06Reviewer summaryAn Agent block writes a short summary per manager: what changed and what looks wrong.
Workflow 3 · Certify
- 07Manager certifiesA Human block asks each manager to keep or remove each flagged entitlement.
- 08Removal ticketsA ServiceNow block opens a ticket for every removal, for IT to action.
- 09Open reviewsA monitor alerts the review owner when certifications are overdue.
This suits regulated environments, privileged and production access, and organisations where people move teams often. It also changes the review itself. Because leavers and conflicting roles are cleaned up as they appear, the certification list is shorter and the manager’s attention goes to items that genuinely need a judgement.
A Monitor watches two things: certifications overdue past your deadline, and flagged items older than your remediation limit. A dashboard built with Dashboards shows completion by department and the number of removals per cycle, with row-level access so each department head sees their own area.
What auditors get in each case
Controls and governance
Run logs
Every workflow run records each block’s inputs, outputs and errors, so a reviewer can trace how a result was reached.
Audit trail
Proposals, approvals, declines and executed actions are written to the workspace audit log, which admins can export.
Roles and permission groups
Admin, write and read roles per workspace, plus permission groups that limit which models, blocks and integrations a team can use.
SSO and SCIM
Sign in through your identity provider with SAML 2.0 or OIDC, and provision people with SCIM.
Row-level access
Row-level policies narrow what each person sees in tables, dashboards, exports and scheduled reports.
Deployed versions
Workflows run from a deployed version, so a change is reviewed before it reaches production runs.
Self-hosting
Run Agent Serve in your own cloud or data centre, next to the systems it reads.
SOC 2 ready
The controls SOC 2 looks for are in place. Agent Serve does not claim a SOC 2 report or certification.
More on how Agent Serve handles access, data and audit on the security page.
With workflows, the evidence exists before anyone asks for it. Each decision is a row with a name and time, each run is traced block by block in Logs, and each removal links to a ticket. Changes to the review workflows are deployed as versions, so you can show which checks were in force during a given cycle. For the evidence pack itself, see audit evidence collection; for the change side of the same control set, see change management approvals.
What you need
- An export or API for accounts and roles from your identity provider and in-scope applications
- An HR feed with each person’s manager, department and leaving date
- A list of in-scope systems and an owner for each
- Your access policy: dormancy limit, conflicting role pairs and review frequency
- A ticketing integration such as ServiceNow for removals
- A review owner who signs off each campaign