Grant or Revoke
Twelve rows from an entitlement review. The trap is that the third option is the right one more often than anyone uses it: cannot judge — the evidence in front of you does not reach the question.
1. A finance analyst holds read access to the ledger reporting group. The row shows the group's documented purpose, the analyst's role, last use two days ago, and an owner who confirmed it this week.
2. A marketing manager is a member of a group granting write access to the payroll file share. Inherited when two teams merged. Last used: never.
3. The row shows a user and a group identifier. No description of what the group grants, no last-use data, no named owner.
4. A support agent holds full CRM administrator. They use it daily — and only ever to reset passwords and merge duplicate records, both available in a lower role.
5. A leaver's user account was disabled on their last day. Their service principal still holds an API key with write access to the customer database. Last used three months ago.
6. The evidence is an undated screenshot of the admin console, sent by the system owner, showing current membership.
7. A database administrator holds production database admin. The row carries the change ticket that granted it, an owner confirmation, and daily use.
8. A finance controller holds write access to every cost centre. Their documented remit covers three of forty.
9. The row shows last used: never. The export covers ninety days. The entitlement was granted four months ago for a quarterly process.
10. An engineer moved from the platform team to a product team eight months ago and retains deploy rights to a production system their new team does not own. Not used since the move.
11. A security analyst holds domain administrator, used weekly to collect logs from domain controllers — a task a read-only log-reader role covers.
12. A contractor holds access to one project folder. The account carries an expiry matching the contract end date, and was used yesterday.
Educational. Entitlement design and review obligations vary by sector and regulator; what transfers is the discipline of asking whether the evidence in front of you reaches the question before you record a decision on it.