Agentic platform
Access reviews
Periodic access certification across your identity providers, automated where it can be and routed for human attestation where it can't.
Access reviews are a SOC 2 CC6 and ISO 27001 A.5/A.8 control. Quarterly (or whatever cadence your policy specifies), someone has to attest that the people with access to your systems still need it.
Radius360 pulls the current state from your identity providers, groups it by access tier, and routes the review to the right owner with one-click approve/revoke decisions.
Setting a cadence
Open Settings → Access Reviews. Pick a cadence (quarterly, semi-annual, annual) and the scope: which providers, which groups, which access tiers. The system schedules the review and emails the assigned reviewer when a window opens.
What gets reviewed
The review surface shows three tiers separately:
- Privileged access — admins, owners, root-equivalent. Always reviewed.
- Standard access — production systems, customer data. Reviewed at the configured cadence.
- Read-only / dormant — surfaced separately, with the Dormant Privilege agent flagging accounts that haven’t authenticated recently.
Connected to the Dormant Privilege agent
When the Dormant Privilege agent surfaces unused admins, those accounts are pre-flagged in the next access review with the agent’s evidence attached. Most reviewers can clear them in one click.The review workflow
- The system opens the review and emails reviewers.
- Each reviewer sees their assigned accounts grouped by access tier.
- For each account: Approve (no change), Revoke (creates a remediation task), or Modify (downgrade tier).
- Reviews require an attestation note when revoking or modifying.
- The system tracks completion. Outstanding accounts at the SLA expiry escalate to the program owner.
Evidence and audit trail
Each review produces an evidence row in the vault tagged to the active audit period: who reviewed, when, what was approved, what was revoked, and what attestation notes were left. This is exactly what an auditor will ask for.
Revocation tasks
A revoke decision creates a mitigation task tied to the IT/security owner of the source provider (M365, Okta, AWS IAM, etc.). The task carries the audit period reference and the reviewer’s attestation. Once closed, the closing evidence links back to the access review record.
Don't bypass
Do not bypass the access review workflow when you discover dormant or over-privileged access between cadences. Use the queue. The audit trail is what makes this defensible.