Access review: turn a permissions export into 'who shouldn't still have this'

Access reviews get skipped because the export is enormous and every row looks fine on its own. The job is really about exceptions: who has access that doesn't fit their role, their status or their activity.

Split it in two, because there are two kinds of rule.

Exact rules are things like "leavers have no access" and "only IT staff hold the admin role". Matching two lists exactly is a spreadsheet job, and a skipped row here is a finding you've missed. Do these with a lookup, or ask the AI to write you the formula or filter. Don't ask it to read thousands of rows and report back.

Judgement calls are the rest: someone in Finance with access to an HR folder, or a person in five groups when their peers have two. These need reading, and an AI tool is useful for them, on a short list rather than the whole export.

Below are the people who are left after my exact checks, with their role,
team and the access they hold.
Rules for who should have access:
- [e.g. Finance share: Finance team and the CFO only]
- [e.g. nobody should be in more than 4 groups without a reason]
List everyone who looks like they break a rule or don't fit their peers,
as a table: name, the access they hold, which rule it breaks, and how
sure you are (certain, probable, check).
Don't assume a rule I haven't given you. If the data is unclear, say so.

Rules: [PASTE]
People and access: [PASTE]

The "don't assume a rule" line matters, because otherwise it applies its own idea of least privilege, which probably isn't how your teams work.

Each result is a lead. A person who "shouldn't" have access might be covering for a colleague. Check with the owner, then write down the decision and the date. That record is what an assessor wants to see.

An export of names, roles and access is personal data, so use an approved tool and redact where you can. Pairs well with the licence audit.