How do I run an access review?

Workforce is in beta. It is listed on the Modules page with no price yet.

How do I open a campaign?

1. Name it and set a due date

   Give the campaign a name and a due date in the future, no more than 90 days away.

2. Narrow the scope if you want

   Optionally limit it to one worker kind (human, agent, service, vendor, team) and one resource type. Keep both on "All" to review every grant.

3. Select Open campaign

   Every active, unexpired grant in scope becomes an item. Protected owner access is left out.

Who reviews each item?

The Reviewer column names the grant holder's accountable owner, or their supervisor if there is no owner — always an active person, never the grant holder and never an agent. An item with neither shows unassigned. The reviewer is who you ask; the decision itself is recorded in ASHR.work by an HR admin, who can add a note to it.

What do Keep, Renew and Revoke do?

• Keep records that the grant is still needed and leaves it as it is.
• Renew gives the grant a fresh default term. A high-risk grant cannot be renewed here — keep or revoke it, then request it again on the Entitlements page so it is approved again.
• Revoke ends the grant straight away.

You cannot decide an item for a grant you hold yourself; the page says so on that row.

What happens when I close the campaign?

Nothing happens on the due date by itself. When an HR admin selects Close campaign, every item still pending has its grant expired with the reason "access review: not reviewed", and the campaign is marked closed. Protected owner access is never touched. Cancel campaign stops a campaign without changing any grant.

How do I keep the evidence?

On a campaign, select Export evidence (CSV) or Export evidence (JSON). Each row shows the grant as it stood, the reviewer, the decision, who made it and when, and what closing did to anything left undecided. Opening, deciding, closing and cancelling are also recorded in the audit log.