Review who has access
Every quarter, check who has access to key tools and flag what looks wrong.
IT and admin · On a schedule · Updated
Works with
- Slack
SlackHow do you run a user access review?
To run a user access review, set a quarterly Loop and give Maito the admin consoles and HR system. It compares accounts with who is employed, then lists leavers still active and contractors with admin rights. It also notes cases where removing an account could break something, like a deploy key.
How it's done today
Access reviews are a yearly scramble before an audit.
What Maito does
- Pull user lists from key tools
- Compare with the HR list
- Flag leavers and odd access
Example
Loop run: Monday 9:00 AM · Quarterly access review
Compared 186 accounts across 5 tools with Gusto (62 employees, 14 contractors). Leavers still active (4): • Marcus, left Sep 12: Google Workspace and GitHub • Tess, left Aug 29: GitHub • Pablo, left Sep 30: Google Workspace Contractors with admin rights (3): Lena and Ravi in GitHub, Jo in Google Workspace. Catch: Marcus's GitHub account owns 2 deploy keys the billing repo uses. Removing him before rotating them would break deploys. I haven't removed anything. Ben decides what goes and in what order.
@Maito put this in a sheet for the audit folder.
Attached: access-review-q4-2026.xlsx, one row per finding, with columns for Ben's decision and the date done. The deploy key note is on Marcus's row.
Maito (9:00 AM):
Compared 186 accounts across 5 tools with Gusto (62 employees, 14 contractors).
Leavers still active (4):
• Marcus, left Sep 12: Google Workspace and GitHub
• Tess, left Aug 29: GitHub
• Pablo, left Sep 30: Google Workspace
Contractors with admin rights (3): Lena and Ravi in GitHub, Jo in Google Workspace.
Catch: Marcus's GitHub account owns 2 deploy keys the billing repo uses. Removing him before rotating them would break deploys.
I haven't removed anything. Ben decides what goes and in what order.
Ben (9:20 AM):
put this in a sheet for the audit folder.
Maito (9:22 AM):
Attached: access-review-q4-2026.xlsx, one row per finding, with columns for Ben's decision and the date done. The deploy key note is on Marcus's row.
How to set it up
- Ask your agent
“On the first Monday of each quarter, check who has access to our main admin consoles and compare it with Gusto. Flag leavers still active and contractors with admin rights. Post it in #it.”
- Use admin consoles
No MCP server needed. Ask your agent to save a skill with the steps, then add the login or API key in Settings → Vault.
- Use HR system
- BambooHR
- Gusto
No MCP server needed. Ask your agent to save a skill with the steps, then add the login or API key in Settings → Vault.
What it won't do
It can only compare tools it can log into, and it doesn't know why an account exists unless told. Removing access stays with your IT team.
Questions
Admin consoles and your HR system, such as Gusto or BambooHR (private beta), through a skill with a login or API key in the Vault.
No. It reports what looks wrong and IT or the tool owner decides. It won't change access without approval.
Yes. A Loop runs on the schedule you set and posts the result to a channel or by email.
