How to Automate Access Reviews Without Rubber Stamping
Access reviews fail quietly. A spreadsheet goes out, managers check every box, the evidence gets filed, and nobody notices that a contractor who left in March still has production database credentials. When you automate access reviews, the goal is not to make the checking faster. It is to make the checking honest: put real evidence in front of the right reviewer, make the risky entitlements impossible to miss, and stop asking humans to confirm things they have no way of verifying.
This guide walks through building that workflow in Skopx, where you create automations by describing them in chat in plain English. There is no drag-and-drop canvas. You write a sentence, the workflow gets built, and you inspect every run step by step.
What a manual access review actually costs
The visible cost of a quarterly review is the hours reviewers spend clicking. The real cost sits in the preparation and the follow-up, both of which usually land on one or two people in IT or security.
| Cost bucket | Where the time goes | What goes wrong |
|---|---|---|
| Extraction | Exporting user lists from each SaaS admin console, one at a time | Exports drift out of date before the review closes |
| Reconciliation | Matching identities across tools to an HR roster | Contractors, service accounts, and shared logins have no clean owner |
| Distribution | Building per-manager sheets and chasing them | Reviewers get a raw list with no context on what an entitlement means |
| Follow-up | Turning "revoke" answers into actual revocations | Decisions are recorded but never executed, so the next cycle repeats them |
| Evidence | Assembling proof that the review happened | Auditors want timestamps and identities, not a final spreadsheet |
Every one of those buckets except the actual decision is mechanical. That is the part worth automating.
Why reviewers rubber stamp
Rubber stamping is a design failure, not a discipline failure. Three things cause it.
The list is too long. If a manager receives 400 rows covering nine systems, approving all of them takes one minute and reviewing them takes three hours. The incentive is obvious.
The rows are meaningless. "jdoe: repo-write on org/infra" tells a non technical manager nothing. Without a plain description of what the permission allows and when it was last used, there is no basis for a decision.
Nothing changes if they say revoke. When reviewers learn that their "remove access" answers vanish into a spreadsheet, they stop bothering to give them.
A good automation attacks all three: it shrinks the list to what actually needs judgment, enriches every row with context, and routes revocation decisions to someone who will act on them within a tracked ticket.
The design: automate access reviews around evidence, not clicks
The workflow does the gathering, matching, enrichment, and packaging. It notifies the humans who own the decision. It does not revoke anything on its own, and it does not record an approval on anyone's behalf.
That last point is deliberate, and it matters for this process more than most. Skopx has no human-approval step. A workflow cannot pause, wait for a manager to click yes, and then continue. For access reviews that constraint is a feature. Automatic revocation of a permission based on a heuristic will eventually lock an on-call engineer out of production during an incident, and an automated approval is exactly the rubber stamp you are trying to eliminate. So the workflow prepares the decision and hands it to a person, every time.
Quarterly access review pack
First weekday quarterly
Pull identity directory
Pull app entitlements
Match to HR roster
AI explains each grant
Write review sheet
Notify each reviewer
The AI step is where the anti rubber stamping work happens. It takes the raw entitlement, the role from the HR record, and the last login timestamp, and writes one sentence a manager can act on: what this permission allows, whether it fits the person's stated role, and whether it has been used recently. It runs on your own provider key, so the enrichment costs you nothing beyond what your provider charges you directly.
What to automate versus what stays human
Draw the line at consequence. Anything that only produces information is safe to automate. Anything that changes who can reach what stays with a person.
| Task | Automate | Stays human |
|---|---|---|
| Collecting user and group lists from each tool | Yes | |
| Matching accounts to the HR roster | Yes | |
| Flagging accounts with no matching employee record | Yes | |
| Flagging dormant privileged access | Yes | |
| Writing a plain-language description of each grant | Yes | |
| Deciding whether a person still needs access | Yes | |
| Revoking a permission | Yes | |
| Approving an exception for a service account | Yes | |
| Recording the reviewer's answer and timestamp | Yes, after the human answers | |
| Escalating an unanswered review | Yes |
Two rules keep this honest. First, the workflow never writes "approved" into an evidence log unless a human explicitly answered. Second, when a reviewer says revoke, the workflow opens a ticket for the person who holds the admin rights rather than calling a delete API itself. The ticket carries the account, the system, the reviewer's name, and the timestamp, so the revocation is traceable and reversible.
If you already run automated vulnerability triage, this will feel familiar: the automation does the classification and assignment, and the human does the thing that carries risk.
Build it in Skopx: automate access reviews in plain English
Connect your identity provider, your ticket tracker, your HR system or roster source, a spreadsheet tool, and your chat platform first. Skopx connects to nearly 1,000 business tools, so the specific vendors matter less than having each connection authorized before you describe the workflow.
Then open chat and describe what you want in one go. Here is the sentence:
On the first weekday of every quarter at 8:00 in America/New_York, pull all active users and their group memberships from our identity provider, pull repository and admin role assignments from our code host, look up each account in the HR roster, and for every account write one row containing the person, the system, the entitlement, their HR status, and the last login date. For each row, use an AI step to write a one-sentence plain-English explanation of what that entitlement allows and whether it matches the person's job title. Put the rows for each manager into a separate sheet, then send that manager a Slack message linking their sheet and asking them to mark each row keep or revoke by the end of the week. Do not revoke anything.
Skopx builds the workflow from that description. A few things worth knowing while you review what it produced.
Trigger. Quarterly is not a native option, so set a weekly schedule and add an if/else condition on the first step that stops the run unless the current date falls in the first week of a review month. Schedules run in the IANA timezone you name, and a run missed by more than two hours is recorded as failed rather than fired late, which is the behavior you want for evidence: a silent late run is worse than a visible failure.
Step budget. A workflow holds up to 20 steps and cannot loop back on itself. That is usually enough for four or five systems. If you cover more, split it: one workflow per system that appends to a shared collection sheet, then a second workflow that builds and distributes the packs.
Data flow. Steps reference each other with expressions. The reconciliation step reads {{ steps.directory.output.users }}, the AI step reads {{ steps.match.output.rows }}, and the notification reads {{ steps.sheet.output.url }}. If a reviewer sheet arrives empty, the expression is the first place to look.
The closing half. Build a second workflow for the return leg. It runs daily, reads the reviewer sheets, and for every row marked revoke it opens a ticket assigned to the system owner. For every row still blank after the deadline, it sends the manager a reminder and copies their director on the third one. That workflow never touches permissions either.
The advanced version: catch risky changes between cycles
Quarterly reviews leave a gap of up to three months. The stronger pattern is a daily sweep that watches for the specific conditions that make access dangerous, and routes only those to a human immediately.
Daily risky-access sweep
Daily 07:00
Fetch access changes
AI classifies risk
High risk?
Open revocation ticket
Alert security channel
Append to quarterly log
The condition uses simple comparisons: the AI step returns a risk label and the if/else checks whether it equals "high", or whether the admin flag is true, or whether days since last login is greater than 60. High-risk items become a ticket with a named assignee and a Slack alert within minutes. Everything else lands in the log that feeds the quarterly pack, so the pack shrinks to items a human has not already handled.
Define "high risk" narrowly at the start: production admin roles, access granted to someone whose HR status is not active, and privileged accounts dormant past your threshold. If the daily alert fires more than a handful of times a week, people will mute it, and you are back to rubber stamping in a different channel. The same restraint applies to incident alerting and on-call handoffs, where alert volume decides whether anyone reads them.
How to tell it is working
Every Skopx run is inspectable. Each step records its real output, how long it took, and the exact error if it failed. Open the run history on the Workflows page after the first cycle and check four things.
Row counts match. The number of rows in the review sheets should equal the number of entitlements in the source systems. A gap means a pagination limit or a permission problem on the connection, not a smaller footprint.
Orphans surfaced. The first real run should flag at least a few accounts with no matching HR record. If it flags zero, the matching logic is probably too loose, for example matching on display name instead of email.
Revoke answers turned into tickets. Compare the count of revoke marks in the sheets against tickets opened. They should be identical. Any drift means the closing workflow is skipping rows.
Response rate improved. Track how many reviewers answered before the deadline compared with your last manual cycle. Enriched, shortened lists get answered. Raw exports do not.
Keep a separate eye on the evidence trail: reviewer identity, decision, timestamp, and the ticket ID for anything revoked. That chain is what an auditor asks for, and it is what makes the review defensible under SOC 2 controls in place.
Common mistakes
Automating the revocation. The tempting next step is "and if the reviewer marks revoke, remove the access." Do not. Sensitive actions get prepared and routed, not executed. One misparsed sheet cell should never cost someone their production access at 2am.
Sending everyone everything. A shared sheet with all 400 rows guarantees rubber stamping. Split by manager, and put the flagged rows at the top of each sheet.
Skipping service accounts. They are the most common source of stale privileged access and the least likely to have an owner. Give every service account a named human owner in your roster before the first run, or the workflow will flag all of them as orphans and reviewers will ignore the noise.
Treating a failed run as a completed review. If the schedule missed its window and the run is marked failed, the review did not happen. Send yourself a notification on failure rather than assuming silence means success. The same discipline applies to backup verification reporting, where a missing report and a clean report look identical if nobody checks.
Letting AI decide instead of explain. The AI step should describe and classify. The keep-or-revoke call belongs to the person accountable for it.
Frequently asked questions
Can Skopx pause the workflow until a manager approves?
No. There is no human-approval step, and no way to hold a run open waiting for a click. The workflow prepares the decision, notifies the reviewer, and a second workflow reads their answer on the next run. For access reviews this separation is healthier anyway, because the human decision is recorded in a system of record rather than buried in a run log.
How often can the review workflow run?
Schedules support 15 minute intervals at minimum, plus hourly, daily, and weekly, in whichever IANA timezone you choose. For quarterly cycles, run weekly and gate the body of the workflow behind a date condition. A run missed by more than two hours is recorded as failed rather than fired late.
What if we have more systems than one workflow can cover?
A workflow holds up to 20 steps and cannot loop. Split the work: a collector workflow per system that appends rows to one shared sheet, then a single packaging workflow that reads the sheet, enriches it, and distributes. Chain them with a webhook trigger so the packaging run starts as soon as the last collector finishes.
Do the AI steps cost extra?
AI steps run on your own provider key with zero markup, so whatever your provider charges lands on your bill directly. Skopx itself is Solo at $5 per month or Team at $16 per seat per month, billed from day one.
Can we trigger a review outside the schedule, like after a reorg?
Yes. Add a webhook trigger with its own secret URL, or run the workflow manually from the Workflows page. A reorg, an acquisition, or a failed audit finding are all good reasons to run an off-cycle pack, and the manual run produces the same evidence trail as a scheduled one.
Skopx Team
The Skopx engineering and product team