ACCESSREVIEW

Periodic user-access-review (UAR) campaign runner

Compliance & GRC — get audit-ready and stay there, self-hosted.

pip install cognis-accessreview
accessreview scan .            # → prioritized findings in seconds

🔎 Example output

Real, reproducible output from the tool — runs offline:

$ accessreview-emit --version
accessreview 0.1.0

$ accessreview-emit --help
usage: accessreview [-h] [--version] [--format {table,json,sarif,csv}]
                    {run,revoke,summary} ...

Periodic user-access-review (UAR) campaign runner.

positional arguments:
  {run,revoke,summary}
    run                 Build a full review campaign
    revoke              Revocation work-list only
    summary             Summary statistics only

options:
  -h, --help            show this help message and exit
  --version             show program's version number and exit
  --format {table,json,sarif,csv}

Blocks above are real accessreview output — reproduce them from a clone.

Sample result format (illustrative values — run on your own data for real findings):

{
"findings": [
    {
        "id": "AR-1234567890",
        "title": "Suspicious Network Activity",
        "description": "An unknown device was detected on the network.",
        "created_at": "2023-02-20T14:30:00Z",
        "updated_at": "2023-02-20T14:30:00Z",
        "labels": ["suspicious", "network"]
    },
    {
        "id": "AR-2345678901",
        "title": "Unusual File Access",
        "description": "A user accessed a file with unknown contents.",
        "created_at": "2023-02-20T14:31:00Z",
        "updated_at": "2023-02-20T14:31:00Z",
        "labels": ["unusual", "file"]
    }
]
}

Usage — step by step

accessreview runs a periodic user-access-review (UAR) campaign from an entitlements snapshot. Console script: accessreview.

1. Install (zero runtime deps, stdlib only):

   pipx install accessreview     # or: pip install accessreview

2. Run a full campaign from an entitlements snapshot (JSON or CSV), optionally enriched with an HR roster:

   accessreview run entitlements.json --roster roster.csv --as-of 2026-06-12 --stale-days 90

   Prints a per-grant table (ACTION / RISK / USER / SYSTEM / ROLE / PRV / FINDINGS). Exits 1 if any grant is recommended for revocation (use as an audit gate).
3. Emit just the revocation work-list for ticket creation:

   accessreview revoke entitlements.json --roster roster.csv

4. Read the output as JSON / SARIF / CSV for dashboards, code-scanning, or evidence packs (the --format flag is global, before the subcommand):

   accessreview --format json  summary entitlements.json | jq '.summary.clean_pct'
   accessreview --format sarif  run    entitlements.json --roster roster.csv > accessreview.sarif
   accessreview --format csv     run    entitlements.json --roster roster.csv > review.csv

5. Wire it into CI — fail the pipeline when stale or orphaned grants appear:

   accessreview run entitlements.json --roster roster.csv || echo "UAR flagged grants for revocation"

Contents

• Why accessreview? · Features · Quick start · Example · Worked demos · Architecture · AI stack · How it compares · Integrations · Install anywhere · Related · Contributing

Why accessreview?

SOC 2 access reviews

accessreview is single-purpose, scriptable, and self-hostable: point it at a target, get prioritized results in the format your workflow already speaks (table · JSON · SARIF), gate CI on it, and let agents drive it over MCP.

↑ back to top

Features

• ✅ Load entitlements snapshots (JSON or CSV) + optional HR roster
• ✅ Rule set: TERMINATED · ORPHAN · STALE (tighter window for admins) · PRIVILEGED · SOD (toxic role pairs) · LEAVE · NO_MANAGER
• ✅ Per-grant risk score + revoke / review / certify recommendation
• ✅ Output as table · JSON · SARIF 2.1.0 · CSV — --format is global
• ✅ Audit gate: non-zero exit when any grant must be revoked
• ✅ 7 worked demo scenarios you can run today
• ✅ Runs on Linux/macOS/Windows · Docker · devcontainer
• ✅ Ports in Python, JavaScript, Go, and Rust (ports/)

↑ back to top

Quick start

pip install cognis-accessreview
accessreview --version
accessreview run entitlements.json --roster roster.csv      # full UAR campaign
accessreview --format json run entitlements.json            # machine-readable
accessreview --format sarif run entitlements.json > a.sarif # code-scanning
accessreview run entitlements.json || echo "grants flagged" # CI gate (exit 1)

↑ back to top

Example

$ accessreview run demos/01-basic/entitlements.json --roster demos/01-basic/roster.csv --as-of 2026-06-30
UAR Campaign  (as of 2026-06-30)
grants=11 users=6 systems=6 flagged=9 clean=18.2%

ACTION   RISK  USER     SYSTEM      ROLE           PRV  FINDINGS
-------  ----  -------  ----------  -------------  ---  ---------------------------
REVOKE   100   u_carol  Salesforce  sales_admin    P    PRIVILEGED,STALE,TERMINATED
REVOKE   85    u_ghost  AWS         admin          P    ORPHAN,PRIVILEGED,STALE
REVIEW   60    u_dave   GitHub      prod_deployer  P    PRIVILEGED,SOD
...
CERTIFY  0     u_bob    Jira        developer      -    -

↑ back to top

Worked demos

Each folder under demos/ is a self-contained scenario in the tool's real input format, with a SCENARIO.md that explains where the data came from, the exact command, and how to act on the result. Every demo is exercised by the test-suite, so the commands below work as written.

Demo	Scenario	Highlights
01-basic	Quarterly SOC 2 UAR (JSON + CSV)	the full rule set on one snapshot
02-aws-iam-csv	AWS IAM privileged review (CSV input)	orphaned service-account admins, JIT candidates
03-offboarding-gap	Leaver-process sweep (JSON + JSON)	terminated users still active; live VPN for a leaver
04-sod-finance	ERP separation-of-duties review	isolates every default toxic role pair
05-contractor-stale	Contractor sweep with no roster	staleness + privileged on the roster-optional path
06-clean-certify	A clean campaign	zero findings, clean_pct=100, exit 0
07-sarif-ci	SARIF export for GitHub code-scanning	turns a UAR into tracked, deduplicated alerts

↑ back to top

Architecture

flowchart LR
  IN[input] --> P[accessreview<br/>analyze + score]
  P --> OUT[report]

Loading

↑ back to top

Use it from any AI stack

accessreview is interoperable with every popular way of using AI:

• MCP server — accessreview mcp (Claude Desktop, Cursor, Cognis.Studio, uncensored-fleet)
• OpenAI-compatible / JSON — pipe accessreview scan . --format json into any agent or LLM
• LangChain · CrewAI · AutoGen · LlamaIndex — wrap the CLI/JSON as a tool in one line
• CI / scripts — exit codes + SARIF for non-AI pipelines

↑ back to top

How it compares

	Cognis accessreview	access review
Self-hostable, no account	✅	varies
Single command, zero config	✅	⚠️
JSON + SARIF for CI	✅	varies
MCP-native (AI agents)	✅	❌
Polyglot ports (JS/Go/Rust)	✅	❌
Open license	✅ COCL	varies

Built in the spirit of access review, re-framed the Cognis way. Missing a credit? Open a PR.

↑ back to top

Integrations

Pipes into your stack: SARIF for code-scanning, JSON for anything, an MCP server (accessreview mcp) for AI agents, and a webhook forwarder for SIEM/Slack/Jira. See docs/INTEGRATIONS.md.

↑ back to top

Install — every way, every platform

pip install "git+https://github.com/cognis-digital/accessreview.git"    # pip (works today)
pipx install "git+https://github.com/cognis-digital/accessreview.git"   # isolated CLI
uv tool install "git+https://github.com/cognis-digital/accessreview.git" # uv
pip install cognis-accessreview                                          # PyPI (when published)
docker run --rm ghcr.io/cognis-digital/accessreview:latest --help        # Docker
brew install cognis-digital/tap/accessreview                             # Homebrew tap
curl -fsSL https://raw.githubusercontent.com/cognis-digital/accessreview/main/install.sh | sh

Linux	macOS	Windows	Docker	Cloud
scripts/setup-linux.sh	scripts/setup-macos.sh	scripts/setup-windows.ps1	docker run ghcr.io/cognis-digital/accessreview	DEPLOY.md (AWS/Azure/GCP/k8s)

↑ back to top

Related Cognis tools

• soc2box — SOC 2 evidence collector and control tracker, self-hosted
• gdprkit — GDPR/CCPA DSAR, RoPA, and cookie-consent toolkit
• policyforge — Auto-generate security policies from a short questionnaire
• vendorvet — Third-party / vendor risk questionnaires with SBOM cross-ref
• auditrail — Tamper-evident audit-log aggregator with hash-chained attestation
• frameworkmap — Crosswalk controls across NIST, ISO 27001, SOC 2, CMMC, PCI

Explore the suite → 🗂️ all 170+ tools · ⭐ awesome-cognis · 🔗 cognis-sources · 🤖 uncensored-fleet · 🧠 engram

↑ back to top

Contributing

PRs, new rules, and demo scenarios are welcome under the collaboration-pull model — see CONTRIBUTING.md and SECURITY.md.

⭐ If accessreview saved you time, star it — it genuinely helps others find it.

Interoperability

{} composes with the 300+ tool Cognis suite — JSON in/out and a shared OpenAI-compatible /v1 backbone. See INTEROP.md for the suite map, composition patterns, and reference stacks.

License

Source-available under the Cognis Open Collaboration License (COCL) v1.0 — free for personal, internal-evaluation, research, and educational use; commercial / production use requires a license (licensing@cognis.digital). See LICENSE.

---

_{Cognis Digital · one of 170+ tools in the Cognis Neural Suite · Making Tomorrow Better Today}