<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: automating-access-review-processes
description: >-
  Automate access review and certification processes including IAM policy audit,
  privilege analysis, dormant account detection, role mining, and access
  certification campaigns with approval workflows.
domain: cybersecurity
subdomain: security-operations-automation
tags:
  - access-review
  - iam
  - certification
  - least-privilege
  - dormant-accounts
  - rbac
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1078"]
---

# Automating Access Review Processes

## Overview

Access review automation identifies excessive permissions, dormant accounts,
orphaned service accounts, and role drift. It generates certification campaigns
that route to managers for approval, tracks attestation completion, and
automatically remediates unapproved access.

Mode: `[MODE: BLUE]` — IAM governance automation.

## Prerequisites

| Requirement | Details |
|---|---|
| Python 3.10+ with `requests` | Required |
| IAM provider API (Okta, Azure AD, AWS IAM) | Required |
| HR system integration for manager mapping | Required |
| Ticketing system for remediation tracking | Required |

## Key Concepts

### Dormant Account Detection

```python
from datetime import datetime, timedelta

def find_dormant_accounts(users: list[dict], threshold_days: int = 90) -> list[dict]:
    """Identify accounts with no login activity beyond threshold."""
    cutoff = datetime.now() - timedelta(days=threshold_days)
    dormant = []
    for user in users:
        last_login = datetime.fromisoformat(user.get("last_login", "2020-01-01"))
        if last_login < cutoff:
            dormant.append({
                "username": user["username"],
                "last_login": user["last_login"],
                "days_inactive": (datetime.now() - last_login).days,
                "account_type": user.get("type", "user"),
            })
    return dormant
```

### Privilege Analysis

```python
def analyze_privileges(user: dict, role_permissions: dict) -> dict:
    """Analyze user's effective permissions for excess."""
    assigned_roles = user.get("roles", [])
    all_permissions = set()
    for role in assigned_roles:
        all_permissions.update(role_permissions.get(role, []))
    used_permissions = set(user.get("permissions_used_90d", []))
    unused = all_permissions - used_permissions
    return {
        "username": user["username"],
        "total_permissions": len(all_permissions),
        "used_permissions": len(used_permissions),
        "unused_permissions": len(unused),
        "excess_ratio": round(len(unused) / max(len(all_permissions), 1), 2),
    }
```

## Workflow

### Step 1: Run Access Review

```bash
node scripts/agent.js --action review --scope admin-users
```

### Step 2: Detect Dormant Accounts

```bash
node scripts/agent.js --action dormant --threshold 90
```

### Step 3: Generate Certification Campaign

```bash
node scripts/agent.js --action certify --scope all
```

## Detection

```yaml
title: Automating Access Review Processes Detection
id: 72465a37-518c-474b-b0d7-45bc22cc8f7d
status: experimental
description: Detects suspicious activity related to automating access review processes techniques in security operations automation context
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    CommandLine: "*automating*access*"
  condition: selection
level: medium
tags:
  - attack.t1078
  - attack.discovery
falsepositives:
  - Orchestration platform executing approved automation workflows
```


**Detection Opportunities**

| Indicator | Source | Detection Logic |
|---|---|---|
| Automating Access Review Processes Detection | linux/process_creation | Sigma rule (medium) |
| ATT&CK Coverage | MITRE ATT&CK | T1078 |

## Verification

- [ ] Dormant accounts detected with accurate last-login data
- [ ] Privilege analysis identifies unused permissions
- [ ] Certification campaigns route to correct managers
- [ ] Remediation actions execute for unapproved access

## References

- [NIST SP 800-53 AC-2 Account Management](https://csrc.nist.gov/publications/detail/sp/800-53/rev-5/final)
- [CIS Control 6 — Access Control Management](https://www.cisecurity.org/controls)
- [Okta Users API](https://developer.okta.com/docs/reference/api/users/)
