Access findings
- Findings: 0, covering 0 actions.
- Explained: 0 with the reason recorded.
AI governance, security and trust
Permissions, approvals and an audit trail
When something goes wrong, nobody can say who could do what, who approved it and when.
Demonstration: Quillfeather Retail Group (fictional) · Retail. Fictional data and a scripted answer.
The situation
- Organisation
- Quillfeather Retail Group (fictional)
- Who is asking
- Internal audit manager
- Industry
- Retail
- What happened
- An audit of the finance system's access found changes that nobody could explain, and the manager wants to see which permission events broke the rules.
The question asked
Which access and approval events this quarter did not follow our own rules, and which have an explanation?
What it reads, and who can see the result
- Permission change log exportGrants, approvals and removals with who and when.
- Access policy documentWho may approve what.
- Reads
- The log of permission events and the access policy.
- Does not read
- The content of the finance records the permissions protect.
- Permission
- Internal audit read access to the log.
- Who sees it
- The internal audit manager and the system owner.
Try it
Review each flagged record: confirm it or dismiss it. The totals and the answer below follow your decisions.
| Account | Event | Approved by | Actions made with it | Finding | Decision |
|---|---|---|---|---|---|
| Analyst 14 | Read access to ledger | Finance manager | 0 | Matched | None needed |
| Analyst 21 | Approval rights granted | Analyst 21 | 38 | Approved by the person receiving the rights | |
| Contractor 07 | Administrator role | IT manager | 112 | Administrator role for a contractor with no end date | |
| Leaver 03 | Account still active | None | 4 | Active 41 days after leaving; four actions since | |
| Manager 02 | Payment release rights | Finance director | 0 | Matched | None needed |
| Service account 9 | Dormant administrator | None recorded | 3 | Privileged account with no owner, idle for 200 days, then three logins from an unrecognised host |
- Flagged
- 4 of 6 · 157
- Raise a finding
- 0 · 0
- Explained
- 0 · 0
- Undecided
- 4 · 157
The answer
Simulated answer. Written for this fictional case, not produced by a live model. Only the figures in it are computed, from what you decided above.
4 of 6 permission events broke the access rules, 157 actions made with them.
Four problems stand out: a person approving their own rights, an open-ended administrator role for a contractor, a leaver's account still active, and a privileged account with no owner that has just started being used from an unknown host [S1][S2]. The leaver's account and that one are the most urgent because actions have already been taken with them.
You have chosen to raise 0 findings (0 actions made) and treat 0 as explained (0); 4 are undecided.
Relies on: S1 · Permission change log, Q3S2 · Access policy
Review and approval
The internal audit manager decides. Approving raises findings with the system owner, who must respond. It does not remove any access or reverse any action.
Not ready to approve. 4 flagged events are still undecided. Confirm or dismiss each one first.
In the product this is a different person with the right permission. Here you play that role to see the rule.
What it produces
Audit trail
- Each finding cites the rule and the log entries.
Limits of this example
- The log shows events, not intent.
- Removing access is a decision for the system owner.
- This is a scripted demonstration on fictional data. No model was called and no real organisation, person or result is shown.
More in AI governance, security and trust
- A Trust and Security area for customersSecurity and procurement teams ask the same questions again and again, and the answers are scattered.
- Govern the AI your organisation usesTeams adopt AI tools faster than anyone records them, who approved them or what they may touch.
- Answers that show their evidenceA fluent answer that cannot show where it came from is a risk, not a help.
- Retention, holds and where work is processedRecords are kept too long or deleted too soon, and nobody can show why.
The AI governance, security and trust story · This capability in the full register