# Run a user access review and flag risky permissions

Compares who has access against job need and flags excess rights, orphaned accounts, and segregation-of-duties conflicts.

- Topic: Legal & Compliance
- Framework: Few-Shot
- Level: Standard
- Tags: HR & Hiring, Leadership, Legal, Analyze, Fill-in Template
- Source: https://www.thinkwithprompt.com/prompts/run-a-user-access-review-and-flag-risky-permissions

## Prompt

```text
Help me run a user access review for one system.

**System:** [e.g. "ERP", "AWS production", "file shares", "Salesforce"]
**Access export:** [PASTE: user, role or group, permissions, last login, account status]
**HR roster or job titles:** [PASTE current employees with department and title]
**Role definitions or expected access:** [what each job should have - or "infer and mark as assumption"]
**Rules that apply:** [e.g. "SOX: no one can create and approve vendors", "least privilege policy"]

Check for:
1. Orphaned accounts: users not on the HR roster (leavers, contractors past end date).
2. Dormant accounts: no login in [NUMBER] days.
3. Privilege creep: access beyond what the role needs, especially admin rights.
4. Segregation-of-duties conflicts I listed, plus any obvious ones you spot (mark as suggested).
5. Shared, generic, or service accounts without a named owner.
6. Role mismatches: people who changed jobs but kept old access.

Return:
- A findings table: User | Finding type | Current access | Recommended action (remove / reduce / confirm with manager) | Risk (high/medium/low).
- A list of questions for each manager to certify their team's access.
- A short evidence summary I can file for auditors (scope, date, reviewer, results, actions).

Do not recommend removing access without listing it for manager confirmation first, except clear leavers.
```

## What to fill in

- e.g. "ERP", "AWS production", "file shares", "Salesforce"
- PASTE current employees with department and title
- what each job should have - or "infer and mark as assumption"
- NUMBER

Free to copy and use. From ThinkWithPrompt (https://www.thinkwithprompt.com/), a library of 2,663 curated AI prompts.