# Access review

URL: /workflows/processes/security/access-review · Id: `workflow:access-review`

> Access review compares every Role’s Permissions with the Verbs it called in the last 30 days, every night, and removes the unused ones.

Access review compares every [Role](/business/nouns/role)’s [Permissions](/business/nouns/permission) with the [Verbs](/business/nouns/verb) it called last month and removes the unused ones.

## Trigger
Runs every day. Part of [Security](/workflows/processes/security), run by the [Engineering Team](/agents/engineering).

## Steps
1. List each Role’s Permissions.
2. Compare them with the Verbs the Role called in the last 30 days.
3. Remove Permissions unused for 30 days.
4. Rotate secrets older than 90 days.
5. Report every widened Permission to the Founder.

## Outputs
- [Permission](/business/nouns/permission)
- [Decision](/business/nouns/decision)

## Example
On the 1st, Access review finds the [Prospector](/agents/sales/prospector) Role has not called `delete` on [Contact](/business/nouns/contact) in 30 days. The Permission is removed, and the [Founder](/agents/founding/founder) reads the report.