The role still needs the account.
Then
Kept, and asked about again at the next review.
Platform / People & access
Know who holds each role and each account.
Keep responsibilities, policy learning, devices and account reviews on each person’s record, so every leaver’s accounts get a decision and every exception has an end date.
Leaver · last day 31 OctTomi Adeyemi
- Duties handed to Halima Sani
- Exit acknowledgement signed
- Laptop KC-0412 to return
- 4 accounts to review
Joins · moves · leaves
Access should change when people do.
Most access mistakes happen at three moments. Asiri gives each one its own checklist, tied to the person’s record.
- JoinsNneka ChukwuLegal counsel, from 2 Sep
- Responsibilities assigned to the role
- Policies sent to acknowledge
- Company laptop declared
- MovesHalima SaniFinance to Operations, 1 Sep
- Old duties handed to a named person
- Learning for the new role
- Accounts reviewed against the new role
- LeavesTomi AdeyemiFinance analyst, last day 31 Oct
- Duties handed over before the last day
- Device return recorded
- A decision on every account
One record per person
Four things a reviewer needs, in one place.
Responsibilities, learning, devices and accounts sit on the same record. When someone asks why a person can reach a system, the answer is beside their role.
- Responsibilities
- Payment approvals · Data protection contactKept apart from the people in your privacy registers
- Learning
- Acceptable use policy v4 · acknowledged 12 SepThe version and the date, not just a tick
- Devices
- Laptop KC-0412 · declaredDeclared devices are labelled as declared
- Access
- 6 accounts · last reviewed 1 OctFrom the directories you connect
The account review
Three answers for every account.
A review asks one question per account: does this role still need it? Each answer starts its own follow-up.
The role no longer needs it.
Then
Stays open until a later inventory shows the account absent or suspended.
Needed for a short, stated reason.
Then
A different manager accepts the bounded risk or returns it. It ends on its expiry date.
Removal, confirmed
A new team. The old approver rights.
Halima Sani moves from Finance to Operations on 1 Sep. The quarterly account review still lists her Finance system access.
Emeka Obi records the removal as required and asks the Finance system owner to remove the role. The review closes when the inventory confirms it.
Fictional company example
Halima SaniOperations · moved from Finance
Inventory · 1 Sep
- Email & calendarActive
- Operations workspaceActive
- Finance system · payment approverActive
Inventory · 1 Oct
- Email & calendarActive
- Operations workspaceActive
- Finance system · payment approverAbsent
The decision, the follow-up and the proof of removal stay on Halima’s record.
Before you start
What people teams ask about access.
Which accounts can Asiri review?
The accounts a connected directory or provider makes available, within the permissions you grant. Devices that people declare are labelled as declared, not as live observations.
Does recording a removal prove the account is gone?
No. Asiri records the decision and who made it. The removal is confirmed only when a later inventory shows the account absent or suspended.
Can the person who proposes an exception approve it?
No. A different company manager must review each exception and either accept the bounded risk or return it for correction.
Start with the people who hold the work.
Connected inventories depend on the configured provider and permissions. Declared devices are not live device observations, and an access-removal intention is not proof that removal happened.