Tips for access inventories
List systems, roles, and named owners — not just accounts.
Include contractors and shared/service accounts.
Review access on a fixed cadence (e.g. quarterly).
Remove access the same day someone leaves a project.
Keep the inventory somewhere auditable, not only in chat.
Who can reach which system
An access inventory lists systems, roles, and owners — including contractors and shared accounts that never show up in HR offboarding.
Fill it from reality (IdP, cloud consoles), not from memory in a workshop.
Fill the access inventory
List systems and owners
Named humans, not “IT”. Include SaaS that billing forgot.
Note privileged and shared accounts
Service users and generic inboxes are where access hides.
Export and review on a cadence
Quarterly is a common default; leavers should be removed the same day.
Access inventory FAQ
Is this an IdP export?
No. It is a document template. Connect it to Okta/AD exports yourself.
Do we upload employee names to you?
No. Text stays in the browser until you copy it out.
What if we have hundreds of apps?
Start with production and admin planes. A complete catalog that is stale is worse than a short live list.