access-lifecycle

1# Access Lifecycle
2 
3> **Portability:** 3 stdlib scripts, no network, no IdP or HR connection. Export CSV, run, keep the output as evidence.
4> **Not audit advice.** Periods and thresholds are your policy; the scripts make you state them.
5 
6Access reviews fail audits in four ordinary ways: the review ran on an incomplete
7export, someone approved their own access, a revoke was decided and never
8carried out, and leavers kept working accounts nobody looked at. Each script
9catches one class of these before the auditor does.
10 
11## Workflow
12 
13```bash
14# 1 - Diff: who has access that the HR roster says they should not?
15python scripts/access_diff.py --roster hr_roster.csv --accounts accounts.csv \
16  --inactive-days 90 --privileged-review-days 90 --as-of 2026-10-31
17# 2 - Campaign: did the review cover everything, and did the revokes happen?
18python scripts/access_review_campaign.py --decisions campaign.csv --population accounts.csv \
19  --remediation-days 10 --close-date 2026-10-20
20# 3 - Map: which controls do the exceptions break, and what evidence do you keep?
21python scripts/control_evidence_mapper.py --diff diff.json --campaign campaign.json --framework soc2,iso27001
22```
23 
24**Step 1** joins each account to the roster on employee ID, then email. A
25terminated person with an enabled account is a blocker; one who logged in after
26their exit date is a worse one. Accounts that match nobody are orphans; service
27accounts need a named owner. Inactivity and privileged-review age use your periods.
28…