✅ Access Reviews
Real IGA (Identity Governance) periodically makes someone look at every entitlement they hold or control and re-attest it. This campaign runs over your own entitlements — your FGA/ReBAC tuples, plus active memberships in organizations you own. Revoking an item is not a flag — it performs a real removal of the underlying grant, right now.
Certify means "still needed, checked." Revoke re-reads the LIVE grant and removes it for real — the same delete an FGA tuple's own delete button, or an organization's remove-member button, would perform. Revoking an org's last active owner is refused, never silently allowed, to avoid stranding a tenant.
Start a campaign
Your campaigns
X-ray
🩻 X-ray — what actually happened
Your own insert-only audit trail — the real server events, sanitized (never a secret), each linked to the lesson that explains it.