Run a user access review and flag risky permissions
Compares who has access against job need and flags excess rights, orphaned accounts, and segregation-of-duties conflicts.
The prompt
Help me run a user access review for one system.
System: [e.g. "ERP", "AWS production", "file shares", "Salesforce"]
Access export: [PASTE: user, role or group, permissions, last login, account status]
HR roster or job titles: [PASTE current employees with department and title]
Role definitions or expected access: [what each job should have - or "infer and mark as assumption"]
Rules that apply: [e.g. "SOX: no one can create and approve vendors", "least privilege policy"]
Check for:
1. Orphaned accounts: users not on the HR roster (leavers, contractors past end date).
2. Dormant accounts: no login in [NUMBER] days.
3. Privilege creep: access beyond what the role needs, especially admin rights.
4. Segregation-of-duties conflicts I listed, plus any obvious ones you spot (mark as suggested).
5. Shared, generic, or service accounts without a named owner.
6. Role mismatches: people who changed jobs but kept old access.
Return:
- A findings table: User | Finding type | Current access | Recommended action (remove / reduce / confirm with manager) | Risk (high/medium/low).
- A list of questions for each manager to certify their team's access.
- A short evidence summary I can file for auditors (scope, date, reviewer, results, actions).
Do not recommend removing access without listing it for manager confirmation first, except clear leavers.
Highlighted [brackets] are blanks to replace with your own details.
Fill in the blanks and use this promptMore Legal & Compliance prompts
What to fill in
- e.g. "ERP", "AWS production", "file shares", "Salesforce"
- PASTE current employees with department and title
- what each job should have - or "infer and mark as assumption"
- NUMBER
How this prompt is built
This prompt follows the Few-Shot structure (Few-shot prompting). A few-shot prompt includes one or more worked examples of the input and the output you want, so the model can copy the pattern instead of guessing it.
Related prompts
- Check auditor independence before accepting a new attest clientA structured independence and threats-and-safeguards review for a CPA firm before taking on an audit, review, or other attest engagement.
- Write an audit finding management will understand and act onTurns my testing notes into a finding with condition, criteria, cause, effect, and a practical recommendation, rated by risk.
- Rewrite a compliance policy so employees can actually follow itTurns a dense compliance policy into clear rules, decision points, and examples, with a mapping so no requirement is lost.
- Assess a conflict of interest disclosure and recommend safeguardsEvaluates an employee's conflict of interest disclosure against policy and recommends whether to approve, mitigate, or decline it.