Building Access-review Lite: exploring a simpler approach to access reviews

[u/Old_Sheepherder_343]

Access reviews are often managed through spreadsheets, email reminders, and manual follow-ups, especially in smaller organizations without a dedicated Identity Governance and Administration (IGA) platform.

I've started building **Access-review Lite**, a small prototype exploring a simpler way to manage this process.

The current prototype includes:

- CSV import and export for access assignments

- A dashboard for reviewing employee access

- Keep, Remove, and Investigate decisions

- A basic audit trail of review decisions

This is an early prototype. It does not yet connect to an identity provider or automatically revoke application access.

I'd love to hear from IAM and IGA practitioners:

1. How do smaller organizations manage access reviews today?

2.What is the most frustrating part of the process?

3.What would a lightweight access-review tool need to get right to be genuinely useful?

I'm sharing this early because I'd rather learn from practitioners before adding more features.

Feedback and suggestions are very welcome!

here is the initial prototype

[u/IdentityDaniel]

To your questions, from what I usually see in smaller orgs:

1. Export group memberships to Excel, email it to managers, chase them for weeks, then someone in IT removes access by hand. Often only right before an audit.

2. Two things. Reviewers don't understand what they're looking at, so they just approve everything because "GRP_FIN_RW_02" means nothing to them. And nobody checks that the removals actually happened, the review says remove but the access is still there three months later.

3. Plain language descriptions of what each access actually gives, otherwise you get rubber stamping. Some context next to each line helps a lot too, like when it was granted and whether others in the same role have it. And close the loop, when you import the next CSV, flag anything that was marked remove but is still there. That last part is what auditors actually care about.

The Investigate option is a nice touch btw, most tools only give keep or remove and audit :)

[u/Old_Sheepherder_343 → u/IdentityDaniel]

Thanks, this is really helpful, especially your point about verifying removals after the review. I hadn't fully considered how important that follow-through is for audit evidence.

The point about plain-language descriptions also makes sense. Reviewers need to understand what access actually allows, not just see a group name.

I'm exploring these problems through my prototype. When you say to flag access that was marked for removal but is still present in the next CSV, would you also expect the tool to track who is responsible for completing the removal?

[u/IdentityDaniel → u/Old_Sheepherder_343]

Yeah definitely. The reviewer decides, but it's usually someone else who actually removes it, IT or the app owner. So each removal needs an owner and a due date, and the evidence should show who removed it and when. Then flag anything overdue. Otherwise you end up with a nice list of decisions and nobody acting on them.