Access review
Shows, in the Platform, Account or Tenant scope you choose, who holds which role, which permission keys the role grants and where the assignment came from.
For: Auditor
What's on this screen
- Scope switcher: every Platform, Account and Tenant in the installation. On opening, the first scope where you hold
audit.readis selected. - Findings: the number of people and assignments, counts by finding type, and the review campaign note for this scope.
- Who holds what: roles per person. Opening a role shows who assigned it, when and with what justification, whether it has been reviewed, and its keys with their risk classes.
What the findings mean
| Finding | What it means |
|---|---|
| Privileged, unknown source | Who granted it is not recorded, and the assignment carries platform authority beyond reading. Look at these first. |
| Unknown source | Who made the assignment is not recorded. |
| Already covered by another role | The same access also comes from another of the person's roles; this assignment may be redundant. |
If a key is marked conditional, the permission applies only when a condition is met.
Keep in mind
Keep in mind Nothing can be changed from this screen; you fix role assignments on the relevant administration screen. The campaign note only says whether a campaign could be opened; campaigns are not opened here.
Tip If you also have access in the scope you chose, the note says so: you can read it, but you cannot close that scope's review yourself. If a permission is missing, the screen shows that audit.read is required and who can grant it.