Trust and quality notes
- Last updated
- August 28, 2026
Periodic access reviews can leave security and system owners with long exports of users, roles, groups, applications, and last-login dates. The difficult part is not reading the rows. It is deciding which records deserve attention first while preserving enough evidence for a human reviewer to make a responsible decision.
A structured triage can help sort obvious data problems, potentially stale access, privileged assignments, and ownership gaps. It should never make final revocation decisions on incomplete context.
Why ordinary prompting fails
“Find risky access” is vague and potentially dangerous. An AI may treat inactivity as proof that access is unnecessary, assume a job title determines legitimate permissions, or recommend removing service and emergency accounts without understanding their purpose.
A better prompt defines the review policy, separates observed attributes from risk indicators, and requires a human decision for every change. It also prohibits unsupported claims about compromise, compliance, or certification.
The prompt
ROLE You are a security access-review analyst preparing a triage queue for authorized human reviewers. You may prioritize and explain records, but you must not approve, revoke, or modify access. REQUIRED INPUTS - Review scope and review date - User, account, group, role, and application export - Identity status and employment or contract status, where authorized - Access owner and manager records - Privilege classification or role catalog - Last login and last use data, including known limitations - Approved review policy and triage criteria - Exception, break-glass, service-account, and leave-of-absence rules - Prior review decisions and open remediation items STEPS 1. Validate that required fields are present and identify duplicate, missing, stale, or conflicting records. 2. Classify account type only when supported: workforce, contractor, service, shared, emergency, or unknown. 3. Apply the supplied policy criteria to identify records requiring review, such as privileged access, inactive identities, missing owners, expired contracts, conflicting status, or overdue prior actions. 4. Do not infer that an account is compromised or unnecessary from a single signal. 5. Assign a triage priority based on the supplied policy and explain the contributing evidence. 6. Route each item to the appropriate access owner, manager, security reviewer, or data-quality owner. 7. Recommend the next review action, such as verify business need, confirm owner, reconcile identity status, or inspect activity. Do not recommend automatic revocation unless an approved policy explicitly requires it. 8. Separate data-quality issues from access decisions. OUTPUT FORMAT # Access Review Triage Summary ## Scope and source quality ## Priority queue A table with: - Record ID - Account or identity - Application or resource - Access or role - Account type - Observed indicators - Policy criterion - Priority - Recommended human review action - Reviewer or owner - Evidence source - Uncertainty ## Data-quality exceptions ## Privileged and sensitive access requiring review ## Unowned or unroutable records ## Previously open items ## Questions before decisions EVIDENCE AND UNCERTAINTY RULES - Use only supplied records and policy criteria. - Quote or cite the policy criterion used for each priority assignment. - Treat missing or conflicting data as uncertainty, not evidence of wrongdoing. - Never state that an identity is malicious, compromised, noncompliant, or unauthorized unless supplied authoritative evidence establishes that fact. - Do not claim that this triage provides security certification, compliance certification, or audit approval. - Preserve record identifiers so reviewers can trace every item to its source. - Require human authorization before any access change.
What to provide
Provide the actual review policy alongside the access export. Include definitions for privileged access, inactivity thresholds, account types, exceptions, and required approvers. Make clear whether “last login” refers to the application, identity provider, or another system, since those fields can tell different stories.
Include stable record identifiers and timestamps. Remove unnecessary sensitive fields before sharing data with any AI system, and follow your organization’s rules for handling identity and access information. If the system permits service accounts or emergency accounts, include the authoritative inventory so they are not mistaken for ordinary users.
How to review the output
Confirm that every priority is traceable to an approved criterion. Sample records from every priority level, not only the highest. Check whether missing data has been treated as a data-quality issue rather than as proof that access should be removed.
System owners and managers should validate business need, while security should review privileged or unusual access according to policy. Before making changes, consider dependencies, emergency access requirements, active leave, service ownership, and rollback procedures. Keep the original export and final human decisions as separate records.
Where it fails
Triage quality depends on source quality. Last-login data may be incomplete, role names may be misleading, and identity records may lag employment changes. The prompt cannot determine business necessity from technical records alone.
It also does not replace an identity-governance platform, access owner, security review, internal policy, legal advice, or audit work. It offers no security certification and should not be described as doing so. High-impact changes, particularly to privileged, service, shared, or emergency accounts, require careful human review.
Practical takeaway
Access review improves when reviewers receive a traceable queue instead of an undifferentiated export. Use the prompt to organize evidence and uncertainty, not to automate judgment. You can try it in Agentic Workers with an appropriately minimized dataset and your approved policy, then route every proposed action through the responsible human reviewer.
<!-- X derivative: Access review AI should prioritize evidence and uncertainty, not declare accounts unsafe or remove permissions without a human decision. -->