Matrixx0070 When to use
Use this on a recurring cadence (quarterly is common), during audits, or after reorgs and offboarding waves. It enforces least privilege and removes access that is no longer justified.
METHOD
- Gather inventory. Collect all identities (users, service accounts, API keys) and their granted roles/permissions across systems. Include group and inherited access.
- Establish expected access. For each identity, determine the role its job actually requires. Note owners and last-login/last-used timestamps.
- Find stale accounts. Flag disabled-but-not-removed users, accounts with no activity past a threshold, orphaned service accounts, and unused API keys.
- Detect over-provisioning. Compare granted vs. required permissions. Flag admin rights, wildcard grants, and standing access that could be just-in-time.
- Detect role drift. Identify permissions accumulated across role changes that were never revoked, and separation-of-duties conflicts.
- Remediate. Recommend revoke, downgrade, or convert-to-JIT for each finding, and require owner attestation for retained access.
OUTPUT FORMAT
- Review scope — systems and identity count reviewed.
- Findings table — Identity | System | Current access | Justified? | Last used | Recommended action.
- Remediation list — revoke / downgrade / attest, with owners.
- Trends — drift or offboarding gaps to fix in process.