Access review evidence

Your auditor’s file, written as the review runs.

The operator drafts each keep or remove with its source, logs every run, and opens tickets once a person approves.

Talk to salesStart free
  • ISO 27001
  • GDPR
  • Every run auditable

Q3 access review

Illustrative review
214 of 214 rows drafted

  • M. Okafor · Salesforce · System AdministratorRemove

    Left on 31 July (HR roster) · last login 94 days ago · from HR roster, Salesforce

  • A. Nowak · Finance app · Payroll ViewerRemove

    Moved from Finance to Marketing on 4 August · from HR roster

  • J. Brandt · Finance app · Vendor Create + Payment ApproveAsk owner

    Can create a vendor and approve its payment · from Finance app export, conflict rules

  • svc-reporting · Finance app · Read all ledgersAsk owner

    Nobody in the HR roster matches this account · from HR roster, Finance export

  • L. Ferrante · Salesforce · Sales UserKeep

    Active · last login 2 days ago · from Salesforce

17 tickets wait behind the approval below.

The run record closes when the tickets open.

Approval required

Open 17 removal tickets in Jira for the IT queue and send 8 owner questions in Slack

Approved by D. Laurent, IAM lead · tickets opened · logged

Declined · nothing sent · not retried

  • 600 hourssaved on access reviews
  • up to 90%less manual work on routine access decisions
  • 70–80%fewer access tickets
  • 75–80%less standing and excess access

Enterprises running operators on Alomana

What goes into the file each cycle

Each row carries the evidence your auditor asks for.

  • Leavers still active

    Matched against the HR roster and drafted for removal

  • Movers with old access

    Compares role changes with what each person still holds

  • Access nobody uses

    Flags last logins past the threshold you set

  • Conflicting duties

    Checks the conflict rules you give it and asks the owner

  • Accounts with no owner

    Lists service and shared accounts no person matches, for IT

  • The evidence

    Writes each decision down with its source, for the auditor

How an access review runs

  1. Connect

    Your exports, Salesforce, Jira and Slack.

  2. Prepare

    The operator compares them and drafts each decision.

  3. Approve

    A person says yes. Tickets open; the run is logged.

Nothing changes without a person's yes.

  • Removals go to IT as Jira tickets; the operator holds no admin rights in your identity provider
  • One yes covers one action; a declined action is not retried
  • Every run logged: input, output, tools, user

Evidence for your auditor

Illustrative review

Approved by D. Laurent, IAM lead · tickets opened · logged

Tickets
  • IT-4821 · Remove M. Okafor from Salesforce (System Administrator)
  • IT-4822 · Remove A. Nowak from the Finance app (Payroll Viewer)
Run record
Input
Q3 review: 4 sources, 214 rows
Output
Decisions drafted, 17 tickets, 8 owner questions
Tools
Code sandbox, Salesforce (read), Jira (17), Slack (8)
User
D. Laurent, IAM lead

What it works with

Measured on

  • Hours spent preparing each review
  • Leavers still active at quarter end
  • Days from leaving to access removed
  • Findings left open for the auditor

Works with

  • Salesforce (read)
  • Jira
  • Slack
  • SharePoint
  • Google Drive
  • Google Sheets
  • Snowflake
  • PostgreSQL
  • CSV and Excel exports
  • Any remote MCP server

Trusted for

  • ISO 27001
  • GDPR
  • Never trains on your data
  • Single-tenant for enterprise

A custom operator typically goes live in up to 4 weeks.

Questions we get

What does the operator do in an access review?

It reads the exports you already pull (identity provider, HR roster, app user lists) and Salesforce permissions, compares them in code, and drafts a keep, remove or ask-the-owner decision for every row with its evidence. Reviewers decide. Approved removals go to IT as tickets.

Does it change anyone's access itself?

No. The operator holds no admin rights in your identity provider or your apps, and Salesforce is read through a read-only connection. It opens a ticket for each removal a person approves, and your IT team makes the change.

Which systems does it work with?

CSV and Excel exports from any system, Salesforce through a read-only connection, and files in SharePoint, Google Drive or Google Sheets. It opens tickets in Jira and messages owners in Slack, each after a person's yes. Other systems can connect through a remote MCP server.

Can the review start every quarter on its own?

Yes. A workflow can start it on a schedule, then send the approver an Approve / Reject message in Slack and wait for the click. Nothing is opened or sent before that yes.

What do we hand the auditor?

Every run is logged with its input, output, tools and user, and the operator writes each decision and its source into a workbook you keep. The auditor sees who decided what, when, and from which evidence.

Is our access data private?

Alomana is ISO 27001 certified and GDPR-compliant, and your data is never used to train AI models. Enterprise deployments run single-tenant, in a dedicated instance.

Bring last quarter's review export.

Talk it over with sales: what the operator needs from your systems, and how it goes live.

Talk to salesStart free

Alomana is a secure enterprise AI platform where autonomous agents, called operators, run business processes end to end. Every run is fully auditable.