Agent skill · alirezarezvani
access-lifecycle
Use when preparing or running a user access review, checking that leavers lost their access, finding orphaned or ownerless service accounts, answering an auditor's access-control request for SOC 2, ISO 27001, PCI DSS, HIPAA or NIST 800-53, or checking whether a finished review campaign will hold up. Diffs the HR roster against account exports, tests the campaign for coverage, self-review, unremoved revokes and rubber-stamping, and maps every exception to the controls it breaks.
What it needs
About 3k tokens when loaded.
What this skill does
Access Lifecycle Portability: 3 stdlib scripts, no network, no IdP or HR connection. Export CSV, run, keep the output as evidence. Not audit advice. Periods and thresholds are your policy; the scripts make you state them. Access reviews fail audits in four ordinary ways: the review ran on an incomplete export, someone approved their own access, a revoke was decided and never carried out, and leavers kept working accounts nobody looked at. Each script catches one class of these before the auditor does. Workflow Step 1 joins each account to the roster on employee ID, then email. A terminated person with an enabled account is a blocker; one who logged in after their exit date is a worse one. Accounts that match nobody are orphans; service accounts need a named owner. Inactivity and privileged-review age use your periods. Step 2 checks the campaign against the export it was built from. An enabled account missing from the campaign means the review did not cover the population, whatever the sign-off sheet says. It also catches undecided lines, self-review, revokes not removed inside your window, late decisions, and a reviewer who kept every line of a large batch at machine speed. Step 3 turns findings into a per-control table: FAIL, EXCEPTIONS, NOEXCEPTIONS, PARTLYTESTED, NOTTESTED or NOTCOVERED, each with what an auditor tests and the evidence to keep. There is no PASS. The gates block on (exit 4) 1. A leaver with an enabled account, or any login after the exit date. 2. A privileged orphan account, or a privileged service account with no owner. 3. An enabled account the campaign never reviewed. 4. An undecided line, a self-review, or a decision with no reviewer named. 5. A revoke or modify with no removal recorded past your remediation window. Hard rules Periods are policy. --inactive-days and --remediation-days have no default. PCI DSS 8.2.6 says 90 days; your policy may differ. Prove removals by re-export. A closed ticket is not evidence the access is gone. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills alirezarezvani/access-lifecycle