# Sec Access Review

> Run a periodic access review for least-privilege, stale accounts, and role drift.

- Skill: `matrixx0070/sec-access-review-2` (Agent Skill)
- Install (CLI): `npx skillmds@latest add matrixx0070/sec-access-review-2`
- Raw SKILL.md: https://api.skillmd.com/api/skills/matrixx0070/sec-access-review-2/raw
- Safety review: pending (external: skill-scanner PASS, skillspector PASS)
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- Author: Matrixx0070 (https://skillmd.com/u/matrixx0070)
- Updated: 2026-09-22
- Page: https://skillmd.com/skills/matrixx0070/sec-access-review-2

---


## When to use

Use this on a recurring cadence (quarterly is common), during audits, or after reorgs and offboarding waves. It enforces least privilege and removes access that is no longer justified.

## METHOD

1. **Gather inventory.** Collect all identities (users, service accounts, API keys) and their granted roles/permissions across systems. Include group and inherited access.
2. **Establish expected access.** For each identity, determine the role its job actually requires. Note owners and last-login/last-used timestamps.
3. **Find stale accounts.** Flag disabled-but-not-removed users, accounts with no activity past a threshold, orphaned service accounts, and unused API keys.
4. **Detect over-provisioning.** Compare granted vs. required permissions. Flag admin rights, wildcard grants, and standing access that could be just-in-time.
5. **Detect role drift.** Identify permissions accumulated across role changes that were never revoked, and separation-of-duties conflicts.
6. **Remediate.** Recommend revoke, downgrade, or convert-to-JIT for each finding, and require owner attestation for retained access.

## OUTPUT FORMAT

- **Review scope** — systems and identity count reviewed.
- **Findings table** — Identity | System | Current access | Justified? | Last used | Recommended action.
- **Remediation list** — revoke / downgrade / attest, with owners.
- **Trends** — drift or offboarding gaps to fix in process.