Security access review workflow
Periodic user access audits with remediation and approval.
Every compliance framework — SOC 2, ISO 27001, HIPAA — requires periodic access reviews: proof that you audited who has access and recertified that each grant is still necessary. But most teams run their access reviews as a chaotic email thread rather than a structured workflow. This diagram makes the process explicit: initiate a review, generate the entitlement report, send it to managers, handle non-response, approve/reject in security, then revoke invalid access and document the remediation.
The decision diamonds mark the friction points. Managers who don't respond get escalated. Access the security team rejects goes back for manager review. Revoked access is verified before the review closes. This workflow is the difference between "we asked managers" and "we have audit evidence that we actually own our access."
When to use this template
- Compliance documentation — auditors want to see your access review process documented, and this diagram becomes your control evidence. It shows they have your sign-off that the process actually runs.
- Access governance design — before building a homegrown entitlement-review tool or configuring one, sketch this diagram with your security team to agree on the escalation thresholds, approval gates, and remediation SLAs.
- Offboarding checklist — this diagram doubles as a checklist for your security operations team: generate the report, send the approval request, wait for security sign-off, revoke the access, verify.
How to adapt it
Customize the escalation and approval gates to your organization:
- Add role-based escalation — access for sensitive systems (databases, production, financial) escalates to the CTO or security officer, not just security; regular system access stays with the manager.
- Insert a manager coaching step — before escalating non-response, send one "here's why this matters" message explaining the compliance requirement.
- Add a remediation SLA — after security approval, revocation must complete within 48 hours; if it doesn't, auto-escalate to the engineering lead.
Visual edits regenerate clean Mermaid code, so you can sketch your exact access-review process and drop it into your runbooks or security wiki.
Mermaid code
Copy it anywhere Mermaid is supported — GitHub, Notion, or your docs.
flowchart TD
A[Initiate quarterly access review] --> B[Generate entitlement report]
B --> C[Manager receives review list]
C --> D{Review each access?}
D -->|No response| E[Send escalation reminder]
E --> F{Still no response?}
F -->|Yes| G[Escalate to security]
F -->|No| D
D -->|Access valid| H[Approve retention]
D -->|Access invalid| I[Mark for removal]
H --> J[Compile remediation plan]
I --> J
G --> J
J --> K{Security approval?}
K -->|Reject| L[Return for manager review]
L --> D
K -->|Approve| M[Revoke invalid access]
M --> N[Send revocation notifications]
N --> O[Verify revocation complete]
O --> P[Document compliance evidence]
P --> Q[Close access review]
Frequently asked questions
- What is a security access review workflow?
- It's a periodic process (often quarterly or annually) where managers review all system access granted to their team members and confirm each one is still needed. It catches stale accounts, departed employees who weren't offboarded, and over-privileged users. The workflow shows decision points, escalation paths when managers don't respond, security approval gates, and the remediation and verification steps that close the loop.
- What is the difference between access review and access governance?
- Access governance is the ongoing policy and architecture — who has the right to grant access, which roles exist, what approval is required. Access review is the audit cycle — executing governance by periodically verifying that granted access still matches policy. This diagram models the review cycle, the place where most over-privileged users get caught.
- Why does this diagram include manager escalation?
- Because non-responsive managers are the biggest bottleneck in access reviews. If a manager doesn't respond, you need an escalation path — typically to their manager or the security team — so the review doesn't stall. Real access reviews add time pressure: if a manager doesn't respond in 5 days, escalate; if they ignore that, auto-revoke or escalate further.
- How do I adapt this for our company's access review cadence?
- Change the trigger at the top to reflect your schedule — monthly, quarterly, or annual. Add your real approval authorities if different from security. If you use a tool like Okta or a homegrown access-management system, add a node showing the data source for the entitlement report. Visual edits regenerate clean Mermaid code, so you can customize this to match your compliance and operational requirements.
Related templates
Role-based access control decision
Authorization logic: user roles, permissions, and resource access checks.
Secrets management and rotation
Credential storage, access, and automated rotation workflow.
Content moderation workflow
User reports, automated checks, review queue, and enforcement.