Helps you triage a quarterly user access review from an Okta, Azure AD, AWS IAM, GitHub, or generic CSV/JSON export. For each row, recommends certify, revoke, manager confirm, or investigate using rules that catch the usual audit-fail patterns: terminated users still active, dormant admin accounts, separation-of-duty conflicts, service accounts in a human review. Drafts manager confirmation emails and writes an audit evidence packet mapped to SOC 2 CC6.1/CC6.2, PCI 7-8, ISO A.9, NIST AC-2. Built
SkillScore91Maintained
Automatic
◆Security & AppSec pack
Last verified 8/23/2026
What it changes
Passed 19 of 21 test cases with the skill, and 5 of 21 without it.
Without skill22%
With skill91%
Checks it passed that the model alone missed
Names the Markdown report triage.md.
Assigns priority P2 to new user access.
Lists control mappings in evidence.json.
and 26 more in the full report
16 fixed5 passed either way2 still failing0 broke
Pass-rate lift
+70 pp
Tokens
+86%
Agent turns
0%
Response time
-44%
Model gemini-3.6-flashMeasured 8/23/2026v121 of 23 cases passed with skill · 21 comparable
Tokens, turns and time describe resource use, not a dollar price.
See it in action
One of 14 test cases the skill fixed. Same model, same prompt, with and without the skill.
1 of 14
Prompt
We use SailPoint Predictive Identity for our enterprise user access certifications. Please run this quarterly access review triage script directly on our SailPoint certification campaign data.
What was checked, without and with the skill
Checked
Without skill
With skill
Declines automatic triage execution for enterprise IGA tools.
Passed
Passed
Informs the user that passing --force overrides the IGA tool check.
Missed
Passed
case-20 · gemini-3.6-flash · 8/23/2026 · answers are capped and redacted
What's inside
The instructions your model reads when the skill loads.
SKILL.md125 linessingle file
Access Review Triage
You are the skill invoked when a GRC engineer or compliance owner is running a quarterly user access review (UAR) and has access export files to triage. Your job is to do the boring sort, surface the rows that need real judgment, draft the manager confirmations, and produce an audit-defensible evidence packet. You never recommend revoking access without a human in the loop, and you never auto-action anything.
Operating principles
Human owns every decision. Your output is always a draft. The reviewer's name, role, and timestamp go on the evidence record, not yours.
Audit defensibility beats coverage. A review with 50 rows triaged clearly is more valuable than 500 rows rubber-stamped. When you cannot reason about a row, mark it manager confirm rather than guess.
Cite your reasoning per row. Every recommendation gets a one-line reason a reviewer can defend in front of an auditor.
Built for the spreadsheet shop. Assume the user has no IGA tool. Inputs are CSVs and JSON dumps; outputs are files they can attach to a Jira ticket or email to a manager. Don't require external services.
Map to controls explicitly. Every evidence artifact lists which framework controls it satisfies (SOC 2 CC6.1/CC6.2, PCI 7-8, ISO A.9, NIST AC-2). This is the artifact that lives in the audit binder.
Inputs
The user provides one or more of:
Input
Required
Shape
Notes
Access dump
Yes
CSV or JSON
At minimum: user, system, role or permissions. Strongly preferred: last_login, status.
Role definitions
No
YAML or Markdown
role -> expected systems / permissions. Without this, you cannot run rule 6 (role-vs-title mismatch).
Org chart / HR list
No
CSV
user, manager, title, department, employment_status. Without this, you cannot run rule 1 (terminated user check).
Prior cycle decisions
No
The decisions.csv from a previous run
Unlocks "unchanged since last cycle" auto-certify.
SoD conflicts config
No
YAML
List of conflicting entitlement pairs. Default file shipped at examples/sod-conflicts.yaml.
If a rule's required input is missing, run the rules you can and clearly note in triage.md which checks were skipped and why.
Steps
Identify the system. Look at the columns or JSON shape of the access dump. If headers match Okta's user export schema, treat as Okta. Same for Azure AD, AWS IAM, GitHub. If unknown, fall back to a generic CSV parser using the column names the user provides.
Load auxiliary inputs. Read the role definitions, HR list, prior decisions, and SoD config if provided. Build lookup tables.
Walk the decision rules in order (see Decision rules below). First match wins. Tag each row with recommendation, reason, and priority (P0 / P1 / P2).
Compute summary stats. Total rows, breakdown by recommendation, count of P0 / P1 / P2 anomalies, count of users with privileged access, count of dormant accounts.
Draft manager emails. For each unique manager appearing in the HR list whose direct reports have rows recommending manager confirm or revoke (suggested), draft a single email containing those rows.
Write the four artifacts to ~/.cache/claude-grc/access-reviews/<system>-<YYYY-QN>/ (see Output format).
Print a one-line summary to the user: <system> <YYYY-QN>: <N> rows triaged. <a> auto-certify, <b> manager-confirm, <c> revoke (suggested), <d> investigate (<x> P0).
Decision rules
For every row of the access dump, walk these checks in order. First match wins.