An access review you can re-run in your browser

Who in a company can do what, and which of those permissions nobody would approve if they were asked today? This page holds a made-up company of 50 people with 114 permission grants between them, runs 13 access-review rules over it, and shows you what comes back. The rules run in your browser — move a slider and the review is recomputed on your machine, not ours. Each finding carries a short explanation written by an AI model beforehand.

Everything here is a signal to investigate, never a conclusion. Access is usually too broad because somebody needed it once and nobody took it back — not because anyone did anything wrong. A rule matching tells you where to look; deciding what it means is the reviewer's job, which on this page is yours.

What the review found

The risk score is a weighted count of findings — a sorting aid so you can watch it fall as you work through the queue. It is not a measurement of anything and it does not compare to any other system's number.

By department

Support comes back with nothing at the default settings, and that is deliberate: everyone in it holds the same small bundle, with no exceptions granted on top. A demonstration where every department is on fire would teach you that these rules fire on everything, which is the same as teaching you they are worthless.

By tier

Change the settings and watch it re-run

These three numbers are judgment calls every access review has to make, and reasonable people set them differently. Move one and the whole review is recomputed on your machine.

The certification queue

This is what a reviewer works through: one finding at a time, certify what is intended and revoke what is not. Your decisions stay in this browser tab and are sent nowhere.

1. Configuration HIGH Holds an administrator profile in an organization above its administrator target

   Rennlo Marlane — IT

   Rennlo Marlane holds the "System Administrator" profile. The org has 6 active administrators against a target of 5.

   Grants involved: System Administrator

   AI-generated risk assessment (pre-computed)

   The System Administrator profile grants broad control over the organization's configuration, users, security settings, and data—essentially the ability to modify how the system operates and who can access what. Rennlo Marlane holds this profile, and the organization currently has 6 active administrators when the target is 5, meaning this account is one above the intended limit. This mismatch warrants review to confirm whether the administrator access is still required for their current role.

   Suggested next step: Confirm with Rennlo Marlane's manager or the IT leadership whether System Administrator access remains necessary for their Platform Engineer responsibilities, and if not, consider removing the profile to align with the administrator target.

   Certify — this is intended Revoke this access
2. Configuration HIGH Holds an administrator profile in an organization above its administrator target

   Talwen Delacand — IT

   Talwen Delacand holds the "System Administrator" profile. The org has 6 active administrators against a target of 5.

   Grants involved: System Administrator

   AI-generated risk assessment (pre-computed)

   The System Administrator profile grants broad control over the organization's configuration, users, and data—essentially the highest level of access available. The organization has set a target of 5 administrators but currently has 6, meaning this account holds a permission that exceeds the intended number of people who should hold it. This signals a need to understand whether Talwen Delacand still requires this level of access for their current role, or whether administrator count has drifted above the organization's own stated limit.

   Suggested next step: Contact Talwen Delacand's manager to confirm whether System Administrator access remains necessary for their Platform Engineer responsibilities, and if not, consider whether this grant should be removed or stepped down to a narrower profile.

   Certify — this is intended Revoke this access
3. Configuration HIGH Holds an administrator profile in an organization above its administrator target

   Cassim Halbval — IT

   Cassim Halbval holds the "System Administrator" profile. The org has 6 active administrators against a target of 5.

   Grants involved: System Administrator

   AI-generated risk assessment (pre-computed)

   The System Administrator profile grants broad control over the organization's configuration, users, security settings, and data—essentially the highest level of access available. Cassim Halbval holds this profile, but the organization has set a target of 5 administrators and currently has 6, meaning this account is one of the excess holders. The review engine flagged this to help ensure administrator access stays aligned with the organization's staffing model and operational needs.

   Suggested next step: Confirm with Cassim's manager or the IT leadership team whether System Administrator access remains necessary for their current Platform Engineer role, or whether a narrower profile would support their responsibilities.

   Certify — this is intended Revoke this access
4. Configuration HIGH Holds an administrator profile in an organization above its administrator target

   Ivette Halbrove — IT

   Ivette Halbrove holds the "System Administrator" profile. The org has 6 active administrators against a target of 5.

   Grants involved: System Administrator

   AI-generated risk assessment (pre-computed)

   The System Administrator profile grants broad permissions across the organization's systems, typically including user management, security configuration, and data access controls. The organization has set a target of 5 administrators but currently has 6, meaning this account holds a high-privilege role that may exceed the organization's intended administrative capacity. This configuration is worth reviewing to confirm whether this level of access remains necessary for the Platform Engineer role.

   Suggested next step: Contact Ivette Halbrove's manager to determine whether the System Administrator profile is still required for current responsibilities, and if not, consider whether stepping down to a more limited profile would align with the organization's administrator target.

   Certify — this is intended Revoke this access
5. Configuration HIGH Holds an administrator profile in an organization above its administrator target

   Phelara Thornmill — IT

   Phelara Thornmill holds the "System Administrator" profile. The org has 6 active administrators against a target of 5.

   Grants involved: System Administrator

   AI-generated risk assessment (pre-computed)

   The System Administrator profile grants broad permissions to manage users, system configuration, and security settings across the organization. Phelara Thornmill holds this profile, and the organization currently has 6 active administrators when its target is 5—meaning there is one more administrator account in the system than planned. This mismatch is worth understanding: either the target should be adjusted, or one of the current administrator accounts should have its privileges reduced.

   Suggested next step: Confirm with Phelara's manager whether the System Administrator profile remains necessary for their current role as Platform Engineer, or whether a more limited profile would be sufficient.

   Certify — this is intended Revoke this access
6. Configuration HIGH Holds an administrator profile in an organization above its administrator target

   Norla Fernsted — IT

   Norla Fernsted holds the "System Administrator" profile. The org has 6 active administrators against a target of 5.

   Grants involved: System Administrator

   AI-generated risk assessment (pre-computed)

   The System Administrator profile grants broad control over the organization's systems, configuration, and user management—essentially the ability to create, modify, or disable accounts and change settings that affect all users. The organization has set a target of 5 administrators but currently has 6, meaning this account holds a privilege level the organization has decided it does not need to maintain at this headcount. This mismatch is worth investigating to confirm whether Norla Fernsted's role still requires this level of access or whether the organization's staffing has shifted since the profile was granted.

   Suggested next step: Contact Norla Fernsted's manager or the IT leadership team to confirm whether System Administrator access remains necessary for their current responsibilities, and if not, whether the profile should be removed or downgraded to align with the organization's administrator target.

   Certify — this is intended Revoke this access
7. Configuration HIGH Holds organization-wide data access without an administrator profile

   Sunnla Halbeth — Marketing

   Sunnla Halbeth carries Modify All Data, View All Data, which reaches every record in the org, but the baseline profile is not an administrator profile.

   Grants involved: All Records Access

   AI-generated risk assessment (pre-computed)

   This account holds permissions to modify and view every record in the organization, which would allow Sunnla Halbeth to read, edit, or delete any data regardless of department or sensitivity level. The configuration is flagged because these organization-wide permissions are typically reserved for administrator profiles, but this account uses a standard Marketing Coordinator profile instead, creating a mismatch between the role's stated function and its actual capabilities.

   Suggested next step: Contact the account owner or their manager to confirm whether organization-wide data access remains necessary for this Marketing Coordinator role, and if not, remove the broad permissions and replace them with access scoped to marketing-relevant records.

   Certify — this is intended Revoke this access
8. Configuration MEDIUM Elevated access on an account that has not signed in recently

   Fennara Marlhollow — Sales

   Fennara Marlhollow has not signed in for 137 days, past the 90-day dormancy setting, and still holds elevated access (View All Financials).

   Grants involved: Financial Reporting

   AI-generated risk assessment (pre-computed)

   This account holds permission to view all financial records in the organization, but the person has not signed in for 137 days—well past the 90-day threshold that usually triggers a review. Because the account remains active and the permission has not been removed, anyone with access to these credentials could currently view sensitive financial data without the account owner's recent involvement. This combination warrants investigation to confirm whether the access is still needed or should be revoked.

   Suggested next step: Reach out to Fennara Marlhollow's manager or the account owner directly to determine whether the Financial Reporting permission is still required for their current role, and if not, request removal.

   Certify — this is intended Revoke this access
9. Configuration HIGH Exempt from multi-factor authentication

   Talara Venkerby — Sales

   Talara Venkerby is exempt from multi-factor authentication. Exemptions are usually granted for an integration and outlive it.

   Grants involved: MFA Exemption

   AI-generated risk assessment (pre-computed)

   This account has been exempted from the requirement to use multi-factor authentication, which means anyone with valid credentials can sign in without a second verification step. MFA exemptions are typically created to support integrations or automated processes that cannot complete a second authentication factor, but these exemptions often persist long after the original need ends. Given that Talara Venkerby is an Account Executive in Sales with an active account and recent sign-in activity, it is worth confirming whether this exemption is still required for their role.

   Suggested next step: Contact Talara Venkerby's manager or the department that granted the exemption to confirm whether the MFA exemption remains necessary for their current work.

   Certify — this is intended Revoke this access
10. Configuration HIGH Holds platform-administration permissions outside IT

    Veywen Brandright — Finance

    Veywen Brandright is in Finance and holds platform-administration access (Manage Users), which is normally held in IT.

    Grants involved: User Management

    AI-generated risk assessment (pre-computed)

    This account holds User Management permissions, which normally allows someone to create, modify, or remove user accounts and change access levels across the organization. Veywen Brandright works in Finance as a Payables Clerk, so the question here is whether a Finance employee needs the ability to manage platform users as part of their regular duties, or whether this permission was granted for a specific task that may no longer be active.

    Suggested next step: Ask Veywen's manager or the Finance department lead whether User Management access is required for the Payables Clerk role, and if so, document the business reason; if not, consider removing the permission.

    Certify — this is intended Revoke this access
11. Configuration HIGH Holds platform-administration permissions outside IT

    Norara Winthand — Marketing

    Norara Winthand is in Marketing and holds platform-administration access (Author Apex), which is normally held in IT.

    Grants involved: Apex Author

    AI-generated risk assessment (pre-computed)

    The Apex Author permission set grants the ability to create, modify, and deploy code and configurations at a platform level—essentially the ability to change how the organization's systems work. Norara Winthand holds this permission despite working in Marketing rather than IT, where such platform-administration capabilities are typically concentrated. This configuration is worth examining because broad code-deployment access in non-IT departments can create unnecessary exposure if that account is compromised or if the access is no longer needed.

    Suggested next step: Contact Norara Winthand's manager or the person who granted this access to confirm whether the Apex Author permission is still required for their current role, and document the business reason if it is.

    Certify — this is intended Revoke this access
12. Configuration HIGH Deactivated account with a live API token

    Norara Rykeerby — Sales

    Norara Rykeerby is deactivated but still holds a live API token. The account's profile at deactivation was "Sales User".

    Grants involved: Sales User, Deal Desk

    AI-generated risk assessment (pre-computed)

    A deactivated account ordinarily cannot sign in or perform actions, but an active API token bypasses that restriction—allowing automated processes or external systems to continue making authenticated requests on behalf of this account. Because Norara Rykeerby's account has been turned off but the token remains valid, anything using that token can still access the Sales User profile and Deal Desk permissions, creating a path for activity that may not be monitored the same way as interactive logins.

    Suggested next step: Confirm with the account owner or their manager whether the API token is still in active use, and if not, request that it be revoked.

    Certify — this is intended Revoke this access
13. Separation of duties HIGH Can both export reports and bulk-export personal data

    Keleen Pellented — Sales

    Keleen Pellented holds both "Export Reports" and "Bulk Export Personal Data", so one account can complete the sequence end to end with no second person involved.

    Grants involved: Sales User, Dashboards, Data Export

    AI-generated risk assessment (pre-computed)

    This account holds two permissions that, together, allow a single person to export standard reports and also to extract bulk personal data from the organization's systems without requiring a second person to review or authorize the export. The combination is worth examining because bulk personal data exports often require additional oversight—a second set of eyes—to ensure the data is being removed for a legitimate business reason.

    Suggested next step: Ask Keleen's manager whether both permissions are needed for their current role, or whether the bulk personal data export permission can be removed or moved to a separate approval step.

    Certify — this is intended Revoke this access
14. Separation of duties MEDIUM Can both change pricing and approve their own opportunity

    Yusla Halbmill — Sales

    Yusla Halbmill holds both "Modify Pricing" and "Approve Own Opportunity", so one account can complete the sequence end to end with no second person involved.

    Grants involved: Deal Desk, Pricing Administration

    AI-generated risk assessment (pre-computed)

    This account holds two permissions that together allow one person to modify deal pricing and then approve that same opportunity without requiring a second person to review the decision. This combination creates a control gap where pricing changes could be approved by the person who initiated them, which is worth investigating to confirm the grants align with the organization's actual separation-of-duties requirements for sales transactions.

    Suggested next step: Ask Yusla's manager whether both permissions are necessary for their current role, or whether the Pricing Administration grant could be removed or restricted to a read-only scope.

    Certify — this is intended Revoke this access
15. Separation of duties HIGH Can both manage users and view all financials

    Veywen Brandright — Finance

    Veywen Brandright holds both "Manage Users" and "View All Financials", so one account can complete the sequence end to end with no second person involved.

    Grants involved: Financial Reporting, User Management

    AI-generated risk assessment (pre-computed)

    This account holds two permission-sets that, in combination, create a control gap: the ability to manage user accounts and the ability to view all financial data. Because both powers reside in one account with no separation of duties required, a single person could theoretically add themselves or others to financial roles, then access the financial records those roles govern, all without a second person's involvement or visibility. This configuration is worth examining to understand whether both permissions are truly necessary for the payables clerk role, or whether one should be moved elsewhere.

    Suggested next step: Ask Veywen Brandright's manager why this account requires both user management and unrestricted financial data viewing permissions, and document whether both are actively used in the payables clerk function.

    Certify — this is intended Revoke this access
16. Separation of duties HIGH Can both create a vendor and approve a payment

    Rennette Fernsurn — Finance

    Rennette Fernsurn holds both "Create Vendor" and "Approve Payment", so one account can complete the sequence end to end with no second person involved.

    Grants involved: Finance User, Payment Approval, Vendor Management

    AI-generated risk assessment (pre-computed)

    This account holds permissions to both create a new vendor in the system and approve payments to vendors, meaning one person could create a vendor and then authorize payment to that same vendor without requiring a second person's involvement or review. This combination is worth investigating because it removes a natural checkpoint—the separation of duties—that normally requires at least two people to complete a financial transaction from start to finish.

    Suggested next step: Ask Rennette's manager whether both vendor creation and payment approval are required for their current role, or whether one of these permissions can be removed or moved to a colleague.

    Certify — this is intended Revoke this access
17. Peer comparison LOW Holds more entitlements than others with the same title

    Rennette Fernsurn — Finance

    Rennette Fernsurn holds 4 entitlements. The median for "Payables Clerk" is 2.0 and this sits more than 2 standard deviations above it.

    Grants involved: Finance User, Forecasting, Payment Approval, Vendor Management

    AI-generated risk assessment (pre-computed)

    This account holds four entitlements—a profile and three permission-sets—which is significantly more than the typical Payables Clerk in the organization, who usually has two. The combination of Forecasting, Payment Approval, and Vendor Management permissions would allow this account to not only process payables but also approve payments and manage vendor data, a scope of authority worth verifying against the person's current role and responsibilities.

    Suggested next step: Contact Rennette Fernsurn's manager to confirm whether the Forecasting, Payment Approval, and Vendor Management entitlements remain necessary for their current work, and document the business reason if they do.

    Certify — this is intended Revoke this access
18. Peer comparison LOW Holds more entitlements than others with the same title

    Veywen Brandright — Finance

    Veywen Brandright holds 4 entitlements. The median for "Payables Clerk" is 2.0 and this sits more than 2 standard deviations above it.

    Grants involved: Finance User, Financial Reporting, Payment Approval, User Management

    AI-generated risk assessment (pre-computed)

    Veywen Brandright holds four entitlements—Finance User, Financial Reporting, Payment Approval, and User Management—which is double the typical access level for a Payables Clerk role in the organization. This combination grants the ability to process payments, view detailed financial reports across the organization, and manage user accounts and permissions, significantly broader than what peers in the same role typically need. The statistical outlier status warrants investigation into whether all four entitlements remain justified by current job duties or whether some were provisioned for a past responsibility and were never removed.

    Suggested next step: Contact Veywen Brandright's manager to confirm whether Payment Approval and User Management entitlements are actively needed for current payables clerk responsibilities, or whether they can be safely removed.

    Certify — this is intended Revoke this access
19. Peer comparison LOW Holds more entitlements than others with the same title

    Talwen Delacand — IT

    Talwen Delacand holds 4 entitlements. The median for "Platform Engineer" is 3.0 and this sits more than 2 standard deviations above it.

    Grants involved: System Administrator, Apex Author, Forecasting, User Management

    AI-generated risk assessment (pre-computed)

    This account holds a System Administrator profile plus three specialized permission sets—a combination that grants both broad system-wide control and deep functional authority across user management, system configuration, and forecasting features. The statistical signal is that Talwen Delacand's entitlement count sits more than two standard deviations above the median for their job title, meaning this configuration is notably different from what peers typically need. This breadth of access is worth confirming, since it may reflect a specific project or past responsibility that is no longer active.

    Suggested next step: Contact Talwen Delacand or their manager to confirm whether all four entitlements remain necessary for current work, and document the business reason for any that are retained.

    Certify — this is intended Revoke this access
20. Peer comparison LOW Holds more entitlements than others with the same title

    Phelara Thornmill — IT

    Phelara Thornmill holds 4 entitlements. The median for "Platform Engineer" is 3.0 and this sits more than 2 standard deviations above it.

    Grants involved: System Administrator, Apex Author, Dashboards, User Management

    AI-generated risk assessment (pre-computed)

    Phelara Thornmill holds four entitlements—including System Administrator, User Management, and two dashboard/authoring permissions—while peers in the Platform Engineer role typically hold three. This combination grants broad authority to modify system configuration, create and manage user accounts, and author dashboards across the organization. The statistical outlier status warrants investigation into whether all four entitlements remain necessary for current job responsibilities, or whether some were provisioned for a past project and can be safely removed.

    Suggested next step: Contact Phelara Thornmill or their manager to confirm which entitlements are actively used for their current role, and document the business justification for any that exceed the standard Platform Engineer baseline.

    Certify — this is intended Revoke this access
21. Peer comparison LOW Holds more entitlements than others with the same title

    Sunnla Halbeth — Marketing

    Sunnla Halbeth holds 2 entitlements. The median for "Marketing Coordinator" is 1.0 and this sits more than 2 standard deviations above it.

    Grants involved: Marketing User, All Records Access

    AI-generated risk assessment (pre-computed)

    Sunnla Halbeth holds two entitlements—a Marketing User profile and an All Records Access permission set—while most peers in the Marketing Coordinator role hold only one. The All Records Access permission set typically grants visibility and modification rights across the organization's entire record base, which is substantially broader than what a Marketing Coordinator position usually requires. This configuration is worth investigating to determine whether both entitlements remain necessary for their current responsibilities or whether the broader access was granted for a specific past need that may no longer apply.

    Suggested next step: Contact Sunnla Halbeth's manager or department lead to confirm whether All Records Access remains operationally necessary for their current role, and document the business justification if it does.

    Certify — this is intended Revoke this access
22. Peer comparison LOW Holds more entitlements than others with the same title

    Norara Winthand — Marketing

    Norara Winthand holds 2 entitlements. The median for "Marketing Coordinator" is 1.0 and this sits more than 2 standard deviations above it.

    Grants involved: Marketing User, Apex Author

    AI-generated risk assessment (pre-computed)

    Norara Winthand holds two entitlements—a Marketing User profile and an Apex Author permission-set—while colleagues with the same Marketing Coordinator title typically hold only one. The Apex Author permission-set appears to grant advanced development or customization capabilities that fall outside the typical scope of a coordinator role. This configuration is statistically unusual enough to warrant clarification about whether both entitlements remain necessary for their current responsibilities.

    Suggested next step: Contact Norara's manager or department lead to confirm whether the Apex Author permission-set is still required for their work, and document the business justification if it is.

    Certify — this is intended Revoke this access
23. Peer comparison LOW Holds more entitlements than others with the same title

    Keleen Pellented — Sales

    Keleen Pellented holds 4 entitlements. The median for "Account Executive" is 2.5 and this sits more than 2 standard deviations above it.

    Grants involved: Sales User, Dashboards, Data Export, Deal Desk

    AI-generated risk assessment (pre-computed)

    Keleen Pellented holds four entitlements that collectively permit them to view sales dashboards, export data from the system, access deal management tools, and operate under the standard Sales User profile. Most Account Executives in the organization hold around 2–3 entitlements; Keleen's four grants are statistically unusual and worth confirming—either because the additional permissions were needed for a specific project or role that has since ended, or because they were provisioned but never actually used.

    Suggested next step: Contact Keleen's manager or the team that provisioned these grants to confirm whether the Data Export and Deal Desk permissions remain necessary for their current responsibilities, and document the business reason if they do.

    Certify — this is intended Revoke this access
24. Peer comparison MEDIUM Direct grant adds permissions the profile does not carry

    Rennette Fernsurn — Finance

    Rennette Fernsurn holds "Vendor Management" as a direct grant. It adds Create Vendor, which the "Finance User" profile does not carry.

    Grants involved: Vendor Management

    AI-generated risk assessment (pre-computed)

    Rennette Fernsurn holds a direct grant of the Vendor Management permission-set, which includes the ability to create vendors. Their assigned profile, Finance User, does not ordinarily include this capability. This means they can perform an action outside the scope of their standard role—worth understanding whether this was intentional and still needed.

    Suggested next step: Ask the department manager or system owner whether Rennette still requires the ability to create vendors as part of their current responsibilities.

    Certify — this is intended Revoke this access
25. Peer comparison MEDIUM Direct grant adds permissions the profile does not carry

    Veywen Brandright — Finance

    Veywen Brandright holds "Financial Reporting" as a direct grant. It adds View All Financials, which the "Finance User" profile does not carry.

    Grants involved: Financial Reporting

    AI-generated risk assessment (pre-computed)

    Veywen Brandright holds a direct grant of the Financial Reporting permission set, which includes the ability to View All Financials. This permission is not part of their assigned Finance User profile, meaning they can see financial data across the organization that their job role would not normally require. This configuration is worth reviewing because direct grants that add capabilities beyond the profile create a gap between what the system expects someone in their role to access and what they actually can access.

    Suggested next step: Ask the Finance department manager or the person who granted this permission whether Veywen needs View All Financials for their current work, and if so, whether the Finance User profile should be updated or if the direct grant should be documented and retained.

    Certify — this is intended Revoke this access
26. Peer comparison MEDIUM Direct grant adds permissions the profile does not carry

    Veywen Brandright — Finance

    Veywen Brandright holds "User Management" as a direct grant. It adds Manage Users, which the "Finance User" profile does not carry.

    Grants involved: User Management

    AI-generated risk assessment (pre-computed)

    Veywen Brandright holds a direct grant of the User Management permission-set, which includes the ability to manage users in the organization. Their assigned Finance User profile does not normally include this capability. This configuration means their account can perform user administration tasks—such as creating, modifying, or disabling user accounts—even though their role as a Payables Clerk would not typically require those powers.

    Suggested next step: Ask Veywen's manager or the person who granted this access whether managing users is a current business requirement for the Payables Clerk role, and if so, whether that need should be formalized in the profile or assigned differently.

    Certify — this is intended Revoke this access
27. Peer comparison MEDIUM Direct grant adds permissions the profile does not carry

    Sunnla Halbeth — Marketing

    Sunnla Halbeth holds "All Records Access" as a direct grant. It adds Modify All Data, View All Data, which the "Marketing User" profile does not carry.

    Grants involved: All Records Access

    AI-generated risk assessment (pre-computed)

    Sunnla Halbeth holds a direct grant of 'All Records Access,' which adds two powerful permissions—Modify All Data and View All Data—that are not part of their standard Marketing User profile. This means their account can read and change any record in the organization, far beyond what a Marketing Coordinator role typically requires. This configuration is worth investigating to determine whether these broad permissions are still needed for their current work.

    Suggested next step: Ask Sunnla's manager or the person who granted this access whether Modify All Data and View All Data remain necessary for their role, and if so, document the business reason.

    Certify — this is intended Revoke this access
28. Peer comparison MEDIUM Direct grant adds permissions the profile does not carry

    Norara Winthand — Marketing

    Norara Winthand holds "Apex Author" as a direct grant. It adds Author Apex, which the "Marketing User" profile does not carry.

    Grants involved: Apex Author

    AI-generated risk assessment (pre-computed)

    Norara Winthand holds a direct grant of 'Apex Author' permission, which allows them to create and modify code within the organization's system. Their assigned profile, 'Marketing User,' does not normally include this capability. This mismatch is worth reviewing because a marketing coordinator typically would not need code authorship permissions, and the direct grant may represent access granted for a specific, time-limited need that was never removed.

    Suggested next step: Contact Norara's manager or the person who granted this permission to confirm whether code authorship remains necessary for their current role, and if not, request removal of the direct grant.

    Certify — this is intended Revoke this access
29. Peer comparison MEDIUM Direct grant adds permissions the profile does not carry

    Talara Venkerby — Sales

    Talara Venkerby holds "MFA Exemption" as a direct grant. It adds MFA Exempt, which the "Sales User" profile does not carry.

    Grants involved: MFA Exemption

    AI-generated risk assessment (pre-computed)

    Talara Venkerby holds a direct grant of 'MFA Exemption' that allows them to bypass multi-factor authentication requirements, a capability not included in the standard 'Sales User' profile they are assigned to. This means their account can authenticate without the additional security layer that applies to other sales staff, which is worth reviewing to confirm the exemption is still needed for their current role and responsibilities.

    Suggested next step: Ask Talara's manager or the team that manages access provisioning why the MFA Exemption was originally granted and whether it remains necessary for their current work.

    Certify — this is intended Revoke this access
30. Peer comparison MEDIUM Direct grant adds permissions the profile does not carry

    Fennara Marlhollow — Sales

    Fennara Marlhollow holds "Financial Reporting" as a direct grant. It adds View All Financials, which the "Sales User" profile does not carry.

    Grants involved: Financial Reporting

    AI-generated risk assessment (pre-computed)

    Fennara Marlhollow holds a direct grant of the Financial Reporting permission-set, which includes the ability to view all financial data across the organization. This permission is not part of their standard Sales User profile, meaning they have access to financial information beyond what their job role typically requires. This configuration is worth reviewing to confirm whether financial visibility is necessary for their current responsibilities as an Account Executive.

    Suggested next step: Contact Fennara's manager or the person who granted this permission to confirm whether the Financial Reporting access is still needed for their current role, and document the business reason if it is.

    Certify — this is intended Revoke this access
31. Peer comparison MEDIUM Direct grant adds permissions the profile does not carry

    Keleen Pellented — Sales

    Keleen Pellented holds "Data Export" as a direct grant. It adds Bulk Export Personal Data, which the "Sales User" profile does not carry.

    Grants involved: Data Export

    AI-generated risk assessment (pre-computed)

    Keleen Pellented holds a direct grant of the 'Data Export' permission-set, which includes the ability to bulk export personal data. This capability is not included in the standard 'Sales User' profile that typically governs their role, meaning they can perform a data export action that their job profile would not normally permit. This configuration is worth investigating to confirm whether bulk export access aligns with their current responsibilities as an Account Executive.

    Suggested next step: Ask the account owner or Keleen's manager whether bulk export of personal data is required for their current work, and if so, document the business justification for the direct grant.

    Certify — this is intended Revoke this access
32. Peer comparison MEDIUM Direct grant adds permissions the profile does not carry

    Yusla Halbmill — Sales

    Yusla Halbmill holds "Pricing Administration" as a direct grant. It adds Modify Pricing, which the "Sales User" profile does not carry.

    Grants involved: Pricing Administration

    AI-generated risk assessment (pre-computed)

    Yusla Halbmill holds a direct grant of 'Pricing Administration' permission, which includes the ability to modify pricing data. Their base profile, 'Sales User,' does not normally grant this permission. This means they can change pricing in ways that the standard sales role is not designed to permit, which is worth confirming against their actual job responsibilities.

    Suggested next step: Ask Yusla's manager or the access administrator who granted 'Pricing Administration' whether modifying pricing is a required part of their current role, and if so, document the business justification.

    Certify — this is intended Revoke this access
33. Peer comparison LOW Holds a grant few departmental peers hold

    Rennette Fernsurn — Finance

    Rennette Fernsurn holds "Forecasting". 0 of 7 other active people in Finance hold it (0%), below the 10% peer setting.

    Grants involved: Forecasting

    AI-generated risk assessment (pre-computed)

    The Forecasting permission set allows an account to access financial planning and projection tools within the organization's system. Rennette Fernsurn holds this permission while none of the other seven active Finance department members do, making it statistically unusual for their role as a Payables Clerk. This configuration is worth examining to understand whether the permission remains necessary for their current responsibilities or whether it was provisioned for a past project and should be reconsidered.

    Suggested next step: Ask Rennette Fernsurn's manager whether the Forecasting permission remains required for their current work, or schedule a brief conversation with Rennette to clarify the business reason for this access.

    Certify — this is intended Revoke this access
34. Peer comparison LOW Holds a grant few departmental peers hold

    Rennette Fernsurn — Finance

    Rennette Fernsurn holds "Vendor Management". 0 of 7 other active people in Finance hold it (0%), below the 10% peer setting.

    Grants involved: Vendor Management

    AI-generated risk assessment (pre-computed)

    The Vendor Management permission set allows accounts to create, modify, and approve vendor records and payment terms within the organization's system. Rennette Fernsurn holds this grant while none of their seven active Finance department peers do, making it statistically unusual for their role as a Payables Clerk and worth confirming whether this elevated capability remains necessary for their current responsibilities.

    Suggested next step: Contact Rennette's manager or the access owner to confirm whether Vendor Management permissions are still required for the Payables Clerk role, and if not, document the removal of this grant.

    Certify — this is intended Revoke this access
35. Peer comparison LOW Holds a grant few departmental peers hold

    Veywen Brandright — Finance

    Veywen Brandright holds "Financial Reporting". 0 of 7 other active people in Finance hold it (0%), below the 10% peer setting.

    Grants involved: Financial Reporting

    AI-generated risk assessment (pre-computed)

    The Financial Reporting permission-set allows the account holder to access, generate, and potentially modify financial reports across the organization. Veywen Brandright holds this grant while none of their seven Finance department peers do, making it an uncommon configuration worth understanding—it may reflect a specific job function, but it could also indicate access that was granted for a temporary need and never removed.

    Suggested next step: Ask Veywen's manager or the Finance department lead whether the Financial Reporting permission-set remains necessary for their current role as a Payables Clerk, or whether it can be safely removed.

    Certify — this is intended Revoke this access
36. Peer comparison LOW Holds a grant few departmental peers hold

    Veywen Brandright — Finance

    Veywen Brandright holds "User Management". 0 of 7 other active people in Finance hold it (0%), below the 10% peer setting.

    Grants involved: User Management

    AI-generated risk assessment (pre-computed)

    The User Management permission-set allows an account to create, modify, and delete user accounts and their access levels across the organization. Veywen Brandright holds this permission while none of their 7 Finance department peers do, making it an uncommon grant for their role as a Payables Clerk—worth investigating whether a Payables Clerk typically needs the ability to manage other users, or whether this permission was granted for a specific past need and has since remained unreviewed.

    Suggested next step: Contact Veywen's manager or the grant owner to confirm whether User Management remains necessary for current job responsibilities, and if not, initiate a removal request.

    Certify — this is intended Revoke this access
37. Peer comparison LOW Holds a grant few departmental peers hold

    Talwen Delacand — IT

    Talwen Delacand holds "Forecasting". 0 of 6 other active people in IT hold it (0%), below the 10% peer setting.

    Grants involved: Forecasting

    AI-generated risk assessment (pre-computed)

    The Forecasting permission-set grants this account the ability to access and potentially modify forecasting data and configurations within the organization's systems. Because none of Talwen's six peer Platform Engineers in IT hold this permission, it stands out as unusual for their role and warrants a review to confirm whether the access remains necessary for their current responsibilities.

    Suggested next step: Ask Talwen's manager or the access owner why Forecasting was granted to this Platform Engineer role and whether it is still required for their work.

    Certify — this is intended Revoke this access
38. Peer comparison LOW Holds a grant few departmental peers hold

    Phelara Thornmill — IT

    Phelara Thornmill holds "Dashboards". 0 of 6 other active people in IT hold it (0%), below the 10% peer setting.

    Grants involved: Dashboards

    AI-generated risk assessment (pre-computed)

    The Dashboards permission-set allows the holder to create, view, and modify data dashboards within the organization's system—a capability that typically supports business intelligence and reporting functions. Phelara Thornmill holds this permission while none of their six active departmental peers do, which is unusual enough to warrant a quick check: either this access supports a specific part of their Platform Engineer role that differs from their peers, or it may have accumulated over time without a current business need.

    Suggested next step: Confirm with Phelara Thornmill or their manager whether the Dashboards permission is actively used in their current platform engineering responsibilities, or whether it can be safely removed.

    Certify — this is intended Revoke this access
39. Peer comparison LOW Holds a grant few departmental peers hold

    Sunnla Halbeth — Marketing

    Sunnla Halbeth holds "All Records Access". 0 of 8 other active people in Marketing hold it (0%), below the 10% peer setting.

    Grants involved: All Records Access

    AI-generated risk assessment (pre-computed)

    The 'All Records Access' permission set allows Sunnla Halbeth to view and potentially modify every record in the organization's system, regardless of department or confidentiality level. This is notably different from their peers in Marketing—none of the other 8 active Marketing staff hold this permission—which makes it worth confirming whether the scope of access matches the actual responsibilities of a Marketing Coordinator role.

    Suggested next step: Contact Sunnla's manager or the person who granted this access to understand whether 'All Records Access' remains necessary for their current work, or whether a narrower permission set would be more appropriate.

    Certify — this is intended Revoke this access
40. Peer comparison LOW Holds a grant few departmental peers hold

    Norara Winthand — Marketing

    Norara Winthand holds "Apex Author". 0 of 8 other active people in Marketing hold it (0%), below the 10% peer setting.

    Grants involved: Apex Author

    AI-generated risk assessment (pre-computed)

    The Apex Author permission set allows an account to create and modify code and automation within the organization's system—a capability that typically belongs to developers and technical architects rather than marketing coordinators. Norara Winthand is the only person in the Marketing department with this grant among 9 active colleagues, which is unusual for a non-technical role and worth confirming whether it remains necessary for their current work.

    Suggested next step: Ask Norara's manager or Norara directly whether the Apex Author permission is still required for their Marketing Coordinator responsibilities, and if not, document the request to remove it.

    Certify — this is intended Revoke this access
41. Peer comparison LOW Holds a grant few departmental peers hold

    Talis Pellented — Marketing

    Talis Pellented holds "Dashboards". 0 of 8 other active people in Marketing hold it (0%), below the 10% peer setting.

    Grants involved: Dashboards

    AI-generated risk assessment (pre-computed)

    The Dashboards permission set allows an account to create, modify, and view dashboards across the organization—a capability that gives broad visibility into organizational data. Talis Pellented holds this permission while none of their eight active peers in Marketing do, making them statistically unusual within their department and worth confirming whether this access aligns with their current role and responsibilities.

    Suggested next step: Ask Talis Pellented's manager whether the Dashboards permission remains necessary for their work as a Marketing Analyst, or whether it should be removed to align with peer access levels.

    Certify — this is intended Revoke this access
42. Peer comparison LOW Holds a grant few departmental peers hold

    Talara Venkerby — Sales

    Talara Venkerby holds "MFA Exemption". 0 of 12 other active people in Sales hold it (0%), below the 10% peer setting.

    Grants involved: MFA Exemption

    AI-generated risk assessment (pre-computed)

    The MFA Exemption permission allows an account to access the organization's systems without requiring multi-factor authentication, bypassing a standard security control that applies to other users. Talara Venkerby holds this exemption while none of their 12 active peers in Sales do, which is unusual and warrants clarification about whether the exemption remains necessary for their current role or responsibilities.

    Suggested next step: Ask Talara's manager or the access owner whether the MFA Exemption is still required for the Account Executive role, and if so, document the business justification.

    Certify — this is intended Revoke this access
43. Peer comparison LOW Holds a grant few departmental peers hold

    Fennara Marlhollow — Sales

    Fennara Marlhollow holds "Financial Reporting". 0 of 12 other active people in Sales hold it (0%), below the 10% peer setting.

    Grants involved: Financial Reporting

    AI-generated risk assessment (pre-computed)

    The Financial Reporting permission-set allows an account holder to view, generate, and potentially modify financial data and reports within the organization's systems. Fennara Marlhollow holds this permission while none of their 12 active peers in the Sales department do, making it statistically unusual for their role and warranting a check that the access aligns with their current job responsibilities.

    Suggested next step: Reach out to Fennara's manager or department lead to confirm whether Financial Reporting access is still needed for their current Account Executive duties, and if so, document the business reason.

    Certify — this is intended Revoke this access
44. Peer comparison LOW Holds a grant few departmental peers hold

    Keleen Pellented — Sales

    Keleen Pellented holds "Data Export". 0 of 12 other active people in Sales hold it (0%), below the 10% peer setting.

    Grants involved: Data Export

    AI-generated risk assessment (pre-computed)

    The Data Export permission-set allows an account to extract data from the organization's systems—potentially including customer information, sales records, or other sensitive business data. Keleen Pellented holds this permission while none of the other 12 active Sales peers do, which is unusual enough to warrant a quick check: either the permission was granted for a specific business need that should be documented, or it may have accumulated over time and no longer be necessary.

    Suggested next step: Ask Keleen's manager or the original access requester whether the Data Export permission is still required for their current role, and if so, document the business justification.

    Certify — this is intended Revoke this access
45. Peer comparison LOW Holds a grant few departmental peers hold

    Yusla Halbmill — Sales

    Yusla Halbmill holds "Pricing Administration". 0 of 12 other active people in Sales hold it (0%), below the 10% peer setting.

    Grants involved: Pricing Administration

    AI-generated risk assessment (pre-computed)

    The Pricing Administration permission-set grants the ability to create, modify, and approve pricing structures and discount rules across the organization. Yusla Halbmill holds this permission while none of their 12 active peers in the Sales department do, making this an uncommon grant worth understanding—either the role genuinely requires pricing authority that others don't, or the permission may have been assigned for a specific project or request and not removed afterward.

    Suggested next step: Contact Yusla Halbmill's manager or the person who granted this permission to confirm whether Pricing Administration remains necessary for their current responsibilities.

    Certify — this is intended Revoke this access

The rules

What this is not

• It is not a completed review of anything. The company is invented and the findings are about invented people.
• It is not a compliance product and produces no certificate, report or attestation. Nothing here is checked against SOX, SOC 2, ISO 27001 or any other framework.
• The peer-comparison rules are the weakest signals on the page and are labeled as such. Being unusual is not being wrong — the one person who can run the year-end close is unusual by definition.
• The written assessments cover the default settings only. Change a slider and some findings will have none, and the page will say so rather than showing you an empty box.

Nothing here has been extracted into its own public repository yet, so this page links to none — naming one that does not resolve would be worse than naming nothing. The rules are internal/iamlab, the company is built by cmd/geniamorg, the assessments by cmd/geniamnarratives, and the browser engine is cmd/iamlab-wasm.