Skip to content

Access Review Procedure

Supports: ../policies/access-control-policy.md. Owner: DIR. Cadence: quarterly, and on any onboarding/offboarding. Evidence output: a dated review record (Tier 2 where it names accounts; the non-identifying summary feeds SEC-12 / GOV-01).

Purpose

Confirm that every human and service identity still needs every grant it holds — least privilege does not survive without periodic pruning.

Scope of each review

  • Human/operator access: GitHub (repo + merge rights), Google Cloud, Apple/EAS, Cloudflare, LinkedIn developer console, the restricted (Tier 2) store, and AWS only if any superseded/future access remains.
  • Service access: DB and Redis credentials and their privilege level.
  • Application: spot-check that object-level authz and block separation still hold for any new read paths added since the last review.

Steps

  1. Enumerate identities. List every human and service identity with access to each system above. (Today: the operator + service credentials.)
  2. Confirm need. For each grant, confirm the role still requires it. Remove anything orphaned, shared, or no-longer-needed.
  3. Confirm MFA. Verify MFA is enabled on every console that supports it.
  4. Confirm secret hygiene. No service credentials in code/logs/repo; all in GCP Secret Manager or approved operator secret store (../policies/cryptography-and-secrets-policy.md).
  5. Check new read paths. For backend code merged since last review, verify each new object read enforces ownership/visibility (no IDOR) and block separation — ties to SEC-04/SEC-15/SAF-01.
  6. Record. Write a dated review record: identities reviewed, changes made, exceptions (with expiry). Update the SEC-12 last-verified date and note in GOV-01 if a decision resulted.

Triggers outside the cycle

  • Onboarding/offboarding (onboarding-offboarding-procedure.md) — review the affected identity immediately.
  • Suspected compromise — out-of-band review + revoke + rotate, as an incident.

Done when

Every grant is justified, MFA is confirmed, no orphaned/shared accounts remain, and the dated record is filed.