Access tends to outlive the reason it was granted. A tool opened for a project in spring is often still open in autumn, long after the project shipped. An access review is the deliberate moment to ask whether each grant should stay, and Folkbase gives that question a dated answer.
How a review works
A review in Folkbase follows four steps:
- Start the review. Folkbase snapshots every active grant in the workspace into a review with a date on it.
- Work through the grants. Reviewers look at each grant and decide whether to keep it or remove it.
- Record the decision. Each keep and each removal is logged against the person it concerns.
- Close it out. The dated review stays as the answer to who had what on that day.
The snapshot matters. Live access changes every week as people join, move, and leave. A review fixes the list at one point in time, so the conversation is about a known set of grants rather than a moving target.
A review gives "who has what" an answer with a timestamp.
Decide with context
The reviewer is often not the person who granted the access. That is why every grant in a review carries the same detail it has on the record: the tool, the scope, who granted it, and the role or request behind it.
That context changes the decision. A grant that came from a role template and matches the person's current role is an easy keep. A grant that came from a one-off request two teams ago deserves a second look. The reviewer can tell the two apart without messaging anyone.
Keep means the grant stays as it is. Remove means the access ends. Both are decisions, and both are recorded.
Pick the cadence
The team chooses when to run a review. Pick a rhythm that fits your risk and your auditors:
- Quarterly, as a standing habit, so drift never builds for long.
- Before an audit, so the evidence is current when the questions arrive.
- After a reorganization, when many people changed teams at once and old access may no longer fit.
Each review is its own dated snapshot. Several reviews over a year give a series of dated answers, each one fixed to its own day.
Decisions on the record
Review decisions are not kept in a separate spreadsheet. Each one is written to the record of the person whose access was reviewed, alongside the rest of their history. Open that person's record and the decisions are there.
That placement answers two questions at once. For the person, it shows every review their access has passed through. For an auditor, each dated review shows what was checked, what was kept, and what was removed. Proving that access was recertified becomes a matter of opening the review, not reconstructing a quarter from email threads. The wider history of changes lives in the audit trail.
Growth and Business plans
Access reviews are part of the Growth and Business plans. Starter includes access grants by role, the material every review starts from. Compare plans on the pricing page.