← All practicals

Run an access review — certify or revoke

Snapshot your own entitlements into a recertification campaign, then decide each one — a revoke really removes the grant.

1. 1

   Give yourself something to review first — write an FGA tuple, or create an organization and add a member — then start a campaign on the Access Reviews lab.

   Real IGA periodically makes someone look at every entitlement they hold or control and re-attest it — starting one SNAPSHOTS your current FGA tuples and every active membership in orgs you own, right now, so the review stays stable even if a grant changes mid-campaign.

2. 2

   Certify one item and revoke another.

   Certify is bookkeeping only — "still needed, checked." Revoke is not: it immediately re-reads the LIVE grant (never the frozen snapshot) and removes it for real — the same store call the FGA lab’s delete button and the Organizations lab’s remove-member button use.

3. 3

   Try revoking your org’s last active owner (if you own one with just yourself in it).

   The revoke reuses orgs.ts’s own last-owner invariant — an access review can propose removing anyone, but it can never strand a tenant without an owner; that one item is refused with last_owner and stays pending.

4. 4

   Close the campaign and read the final tally.

   Closing is the attestation: “as of this date, every entitlement was reviewed” — the pending/certified/revoked counts are exactly what an auditor asks a real access-review campaign to prove.