Quick answer
Access reviews (/admin/access-reviews, HR admins only) check that every grant on the Entitlements page is still needed. An HR admin opens a campaign, every active grant in scope becomes an item, an HR admin decides Keep, Renew or Revoke for each one, and an HR admin closes the campaign. Each decision is kept as evidence with who decided and when.
Workforce is in beta. It is listed on the Modules page with no price yet.
How do I open a campaign?
Name it and set a due date
Give the campaign a name and a due date in the future, no more than 90 days away.Narrow the scope if you want
Optionally limit it to one worker kind (human, agent, service, vendor, team) and one resource type. Keep both on "All" to review every grant.Select Open campaign
Every active, unexpired grant in scope becomes an item. Protected owner access is left out.
Who reviews each item?
The Reviewer column names the grant holder's accountable owner, or their supervisor if there is no owner — always an active person, never the grant holder and never an agent. An item with neither shows unassigned. The reviewer is who you ask; the decision itself is recorded in ASHR.work by an HR admin, who can add a note to it.
What do Keep, Renew and Revoke do?
- Keep records that the grant is still needed and leaves it as it is.
- Renew gives the grant a fresh default term. A high-risk grant cannot be renewed here — keep or revoke it, then request it again on the Entitlements page so it is approved again.
- Revoke ends the grant straight away.
You cannot decide an item for a grant you hold yourself; the page says so on that row.
What happens when I close the campaign?
Nothing happens on the due date by itself. When an HR admin selects Close campaign, every item still pending has its grant expired with the reason "access review: not reviewed", and the campaign is marked closed. Protected owner access is never touched. Cancel campaign stops a campaign without changing any grant.
How do I keep the evidence?
On a campaign, select Export evidence (CSV) or Export evidence (JSON). Each row shows the grant as it stood, the reviewer, the decision, who made it and when, and what closing did to anything left undecided. Opening, deciding, closing and cancelling are also recorded in the audit log.
Frequently asked questions
- Does an access review close itself on its due date?
- No. An HR admin closes it with Close campaign. A campaign past its due date stays open and is shown as past due until someone closes or cancels it.
- What happens to grants nobody reviewed?
- When an HR admin selects Close campaign, every grant still pending is expired with the reason "access review: not reviewed". Owner access is never part of a review and is never touched.
- Can I review my own access?
- No. Someone else must decide any grant you hold, and an agent or service can never review access.
This guide also lives in the help centre at /help/admin/access-reviews, which is its canonical home.