Access Review DeskFree tool by Agent Trust Cloud

Free · private · no sign-up

Run a user access review in minutes

Auditors (SOC 2, SOX, ISO 27001) expect periodic reviews of who has access to what. Paste an access export to flag the accounts that need action (leavers, inactive, orphaned, privileged, unowned service and AI-agent accounts, and segregation-of-duties conflicts) and download a review workbook for sign-off.

Review my access list

1. Add your access list

Columns: User, Application, Role, Last login, Manager (or owner), Status (active/terminated), Account type (human, service, bot/agent).

days

Review AI agents and service accounts too

Non-human identities now outnumber people in most companies. Agent Trust Cloud discovers AI agents and service accounts, maps what they can access, and runs approval-based access reviews with evidence for auditors.

See Agent Trust Cloud

How to run a user access review

  1. Export users, roles and last-login dates from each in-scope application.
  2. Flag the risky accounts (this tool does that step).
  3. Send each manager or system owner their list to confirm keep or revoke.
  4. Remove access marked revoke, and record the date.
  5. Keep evidence: the export, the decisions, who approved and the removal proof. Auditors ask for all four.

How often?

Quarterly for privileged and financial systems is common, and at least yearly for everything else. Check your own control framework and auditor's expectations.

Questions

What is a user access review?

A periodic check that each person and system account has only the access their job needs, with a manager or owner confirming each one.

What is segregation of duties?

A control that stops one person holding two conflicting roles, such as creating vendors and approving payments, so no one can commit and hide an error or fraud alone.

Should service accounts and AI agents be reviewed?

Yes. Every non-human account should have a named owner and least-privilege access, and be reviewed like any user.

Is my data uploaded?

No. The review runs in your browser. Nothing is sent to a server.

Last reviewed 27 September 2026.