Before
An administrator periodically reviewed grant records to identify expired access, matched each record to the relevant user and group, and removed the membership manually. The administrator then updated the grant record to show that the temporary access had been revoked.
How it works
- Start an expired-access review and retrieve active just-in-time grants whose expiration time has passed.
- Process each expired grant by removing the associated user from the named group.
- Mark the corresponding grant record inactive and record the automated revocation.
Workflow details
- Trigger and retrieval: A webhook-triggered run starts the expired-access review, which can represent the original recurring check that ran every 15 minutes. The workflow queries the grant records for active just-in-time access whose expiration time is earlier than the current time.
- Grant-by-grant processing: Each expired grant is handled individually, using the grant’s recorded user and group identifiers to determine which temporary membership must be removed.
- Access removal: The workflow removes the user from the named group, revoking the expired entitlement without requiring an administrator to cross-reference the grant with the group membership.
- Record closure: After the membership removal, the workflow updates the associated grant record to make it inactive and records that it was revoked by the automated process.
- Operational result: The completed run leaves expired access removed and the corresponding grant records closed. If a service operation fails, the flow stops rather than silently continuing with incomplete processing.
What changed
Expiration checks, entitlement removal, and grant closure now occur in one sequential workflow, with the grant record supplying the user and group details needed for the revocation and documenting the completed action.
Work removed
Reviewing grant records one by one for expired dates, cross-referencing users and groups, removing each group membership, and updating each grant record to show closure.
Expected outcome
For each expired grant, at least two recurring manual updates—membership removal and grant closure—are replaced, reducing the likelihood that temporary access remains active after its approved period.
