How-to

Review who can access what in a scope

On the Access review screen you pick a scope and read each assignment's role, the keys it grants, its risk and where it comes from.

For: Auditor, Platform administrator, Account administrator, Tenant administrator

Prerequisite

audit.read in the scope you review. The Auditor archetype carries it; nothing can be changed from this screen.

Steps

Open Access review under Operations and audit.
Pick the scope you want to review.
See in the list who holds which role.
Open an assignment: read its reason, the keys it grants and each key's risk.

Flags

Source unknown: who gave the assignment is not recorded.
Privileged: the assignment carries a permission other than read in the platform scope.
Risk comes from the key's verb: purge critical, publish high, write medium, read low.

Going deeper

In a tenant, the tenant's Access screen shows which role and which scope each key comes from, and which capabilities and workspaces that access reaches. The “Inherited” flag there says the key comes from a role given in the account or on the platform.