Harbor Access / 07 / PRACTICE GUIDE
Access reviews and audit evidence
Turn a periodic approval list into an effective access review. Track indirect permissions, business rationale, applied outcomes and time-bound exceptions.
Download guide and workpapersOriginal AI-assisted SecNet educational content; examples are fictional. Not a source organization publication or endorsement. Sources checked: 2026-10-21.
EVIDENCE REVIEW DESK
Move from observations to decisions.
Code here is a local policy model with no target connection. Passing model cases are not security approval or device tests.
The spreadsheet arrived / Incomplete decision
Inspect an incomplete decision based on record existence or another positive signal. Consider denial cases alongside permitted use.
s => s.listExported === trueAn export establishes neither indirect access nor complete scope. Collecting approvals without ownership, period and group/application boundaries produces weak evidence.
Choices and outputs last only on this open page; they do not update account progress, career status, points or certificates.
01 / EXPLANATION
Define scope rather than just exporting a list
A Harbor auditor exports an application user list. It may show direct assignments while omitting groups, guests, service identities or temporary privilege. State the review period, source, data date and exclusions. Reviewers need enough context to assess business need; manager and resource-owner roles can differ. Product review types and licensing vary, so this lesson assumes no feature is available in every tenant. The export is a scoped starting record, not comprehensive access evidence. Match the review question to the permissions the source can actually describe.
02 / EXPLANATION
Explain approval decisions
Recent sign-in or active-user status alone is not a business need. Explain decisions through task, data sensitivity, owner and duration. A reviewer approving their own access still raises independence questions. Harbor distinguishes retain, remove, request evidence and time-bound exception outcomes. Define nonresponse handling beforehand; automatic removal is not a universal default without considering effects. The exercise grants or removes no real account or employment access. A rationale should let another authorized reviewer understand why that particular permission remains necessary.
03 / EXPLANATION
Apply decisions and verify outcomes
A remove decision leaves risk unchanged if never applied. Even an applied result may leave access through nested groups or local application accounts. Record execution ownership, time, failures and authorized re-access testing. Harbor’s local desk illustrates an indirect group grant but does not validate any product’s applied outcomes. Decision completion and effective permission change are separate evidence items. That distinction allows an audit to demonstrate a control outcome rather than merely an approval percentage, while keeping unresolved access paths visible for follow-up.
04 / EXPLANATION
Retention, exceptions and triggers
Audit evidence records source revision, reviewer role/person, rationale and outcome without secrets or unnecessary personal data. Retention follows authorized organizational policy; this package sets no universal period. Role moves, contract endings or high-risk changes may trigger review alongside periodic cycles. Exceptions need an explicit risk owner, scope, compensation and expiry. Repeated unjustified extensions should not replace normal access governance. Complete the review with outstanding work, owners and a validation plan rather than treating unanswered or unapplied decisions as successfully closed.
Build the evidence yourself.
Blank workpapers are not completed tests. Fill them in your authorized environment without secrets or real personal data.
Full guide with code, outputs and reasoning ↓Primary references
Explanations are authored by SecNet. References support method and platform context; verify current editions and organizational policy for real use.