> ## Documentation Index > Fetch the complete documentation index at: https://docs.ravenna.ai/llms.txt > Use this file to discover all available pages before exploring further. # Access reviews > Run access reviews in Ravenna: snapshot who has access to your applications, have managers or app owners approve or deny it, act on denials, and export the evidence. Access reviews is in beta and available to selected organizations. To request access, contact your Ravenna representative, or reach out to the Ravenna team on Slack or through the in-app chat. Testing it? See the [beta tester guide](https://docs.ravenna.ai/documentation/automate/access-management/access-reviews/beta). An access review checks that everyone who has access to your applications still needs it. You choose the applications, and Ravenna takes a snapshot of who has access to each one. Each person's access goes to a reviewer, usually their manager or the application's owner, who approves or denies it. You then act on every denial and export the decisions as evidence for your auditors. > [!NOTE] > > Only organization admins can create, start, end, cancel, and export access reviews. Reviewers see only the reviews and the access assigned to them. See [Complete an access review](https://docs.ravenna.ai/documentation/automate/access-management/access-reviews/reviewers.md). *** ## How an access review works **1. Create a draft** Name the review, choose an owner, choose who reviews, set a due date, and select the applications in scope. **2. Start the review** Ravenna takes a snapshot of who has access to each application at each access level, and assigns every person's access to a reviewer. **3. Reviewers decide** Each reviewer approves or denies the access assigned to them, one application at a time. **4. Act on access changes** Every denial appears on the **Access changes** tab. You revoke the access, keep it with a reason, or mark it removed in your identity provider. **5. End and export** End the review when reviewers are done, then export the decisions for your records. ### Review statuses | Status | Meaning | | - | - | | Draft | The review is being set up. You can still edit everything. | | Scheduled | The review starts on its own at its start time. You can still edit it until then. | | In progress | The review has started. Reviewers can record decisions. | | Overdue | The review is in progress and its due date has passed. Reviewers can still record decisions. | | Completed | You ended the review. Reviewers can no longer record decisions, but you can still act on denials. | | Canceled | You canceled the review. Reviewers no longer see it. | *** ## View reviews Open **Reviews** in the sidebar. Organization admins see every review in the organization, with counts of total, in progress, and completed reviews. Each row shows the review's name, status, owner, type (**Adhoc**, **Scheduled**, or **Recurring**), applications, and due date. Click a review to open it. * **Search** by name. * **Filter** by status, owner, application, due date, start date, or created date. * **Group** by status, owner, or type. * **Sort** by created date, name, or due date. To act on several reviews at once, select draft, scheduled, or in-progress reviews and choose an action: * **Complete** ends every selected review, the same as [ending a review](#end-a-review). It's available when every selected review is In progress. * **Cancel** cancels every selected review, the same as [canceling a review](#duplicate-or-cancel-a-review). *** ## Create a review **1. Start a new review** In **Reviews**, click **New**. If your organization has no reviews yet, click **New review**. **2. Name and describe it** Enter a name, such as **Q4 2026 SOC 2 review**, and an optional description. **3. Set the scope** * **Owner:** the person responsible for the review. It defaults to you and must be an active member of your organization. When no one else qualifies to review someone's access, the owner reviews it. * **Reviewers:** who decides on each person's access. Choose **Manager**, **App owner**, or **Manager, then app owner**. **4. Choose when it runs** In **Date and time**, choose a type: * **Adhoc:** you start the review yourself. Optionally set a **Due date** for reviewers. * **Scheduled:** the review starts on its own at the **Start date** and time you choose, in your time zone. Optionally set a **Due date** after the start. * **Recurring:** the review repeats on its own. Choose a **Frequency** (**Every month**, **Every quarter**, or **Every year**), when the **First run** starts, and the **Time to review** each run (7, 14, 30, 60, or 90 days). Each run is due that many days after it starts. **5. Select applications** Search the list and select each application whose access you want reviewed. The list shows applications that aren't archived and have at least one access level that isn't archived. Each application shows its status and how many entitlements it has, counted the same way a review's snapshot counts them. Filter the list by application status. Ravenna saves the draft as you go, once it has a name and at least one application. Close it and come back from **Reviews** at any time. ### How Ravenna picks each reviewer When the review starts, Ravenna assigns each person's access to the first eligible reviewer from the source you chose: | Reviewers setting | Reviewer for each person's access | | - | - | | **Manager** | The person's manager. | | **App owner** | An owner of the application. Owners set as a user group count every member of the group. | | **Manager, then app owner** | The person's manager. If they have no eligible manager, an owner of the application. | A reviewer must be an active member of your organization and is never the person whose access is being reviewed. When no one qualifies, the review's owner reviews that access. Learn more about setting [application owners](https://docs.ravenna.ai/documentation/automate/access-management/applications.md#setting-up-applications) *** ## Start a review Open the draft and click **Start review**, then confirm. For a scheduled or recurring review, click **Schedule review** instead, then confirm. The review moves to Scheduled and starts on its own at its start time. Until then: * Edit any setting. If you change the start time, click **Reschedule** to save it. * Click **Start now** to start it right away. * Choose **Unschedule** from the **More actions** menu to move it back to Draft. Starting takes a snapshot of who has access to the selected applications right now. The snapshot includes: * Access granted through a Ravenna access request that's currently active. * Access people hold through an identity provider group linked to one of the application's access levels. Ravenna creates one row for each person and access level, and assigns it a reviewer. From then on, the review's settings are locked. Starting fails if nobody currently has access to any of the selected applications. ### Recurring reviews Each run of a recurring review is its own review. When a run starts, Ravenna creates the next run as a new Scheduled review with the same settings, one frequency period later. If nobody has access when a run is due to start, that run moves to its next date. Each run needs an owner who's an active member of your organization. To stop the series, cancel or unschedule the next scheduled run. *** ## Track progress Open an in-progress review to see its owner, start date, due date, and these counts, which stay visible on every tab: * **Applications in scope:** applications in the review. * **Entitlements in scope:** rows in the review, one for each person and access level. * **Entitlements reviewed:** rows with a decision. * **Entitlements changed:** rows reviewers denied. The review has three tabs: | Tab | What it shows | | - | - | | **Applications** | Each application in the review, with its reviewers, progress, and status. An application where nobody had access shows as Completed. Click an application to see every row, its reviewer, and its decision. Click a person to open their [access history](https://docs.ravenna.ai/documentation/automate/access-management/access-reviews/reviewers.md#see-a-persons-access-history). | | **Reviewers** | Each reviewer, the applications assigned to them, their progress, and status. | | **Access changes** | Every row a reviewer denied, and what you've done about it. | Search, filter, and sort each tab. If you're also a reviewer on the review, you can approve or deny your own rows, one at a time or in bulk, as described in [Complete an access review](https://docs.ravenna.ai/documentation/automate/access-management/access-reviews/reviewers.md#approve-or-deny-access). *** ## Act on access changes Every row a reviewer denies appears on the **Access changes** tab as Awaiting action. Each row shows the person, application, access level, who denied it, and when. For each denial, choose one of these: | Action | When to use it | Result | | - | - | - | | **Revoke** | The access was granted through a Ravenna access request. | Ravenna revokes the person's entitlement, the same as revoking it from the application's **Entitlements** tab, with the review's name in the revoke note. The row shows Revoke requested. | | **Keep** | The person should keep the access. | Enter a reason, which is required. The row shows Kept. | | **Mark removed in IdP** | The access comes only from an identity provider group. | Remove the person from the group in your identity provider first, then choose **Mark removed in IdP** from the row's menu. The row shows Removed in IdP. | Each action records who took it and when. You can act on denials while the review is in progress and after you end it. Learn more about [revoking entitlements](https://docs.ravenna.ai/documentation/automate/access-management/entitlements.md#revoking-entitlements) *** ## End a review When reviewers are done, open the review and click **End review**, then confirm. The review moves to Completed. Reviewers can no longer record decisions, and you can still act on access changes. *** ## Export decisions Open a review and click **Export**. Ravenna downloads a CSV named after the review and today's date, with one row for each person and access level: | Column | Contents | | - | - | | Review | The review's name. | | Application | The application. | | Person, Person Email | Whose access was reviewed. | | Access Level | The access level reviewed. | | Reviewer, Reviewer Email | Who the row was assigned to. | | Decision | Approved, Denied, or Pending. | | Decided At, Decision Note | When the reviewer decided, and their note. | | Follow-up | For denials: Awaiting action, Revoke requested, Kept, or Removed in IdP. | | Follow-up At, Follow-up By, Follow-up Note | When an admin acted on the denial, who did, and their note or reason. | *** ## Duplicate or cancel a review From the **More actions** menu on a review, or the row menu in **Reviews**: * **Duplicate** creates a new draft with the same name, description, reviewers, applications, frequency, and time to review, owned by you. * **Cancel review** stops a draft, scheduled, or in-progress review. Reviewers stop seeing it and decisions stop. Canceling is permanent. *** ## Audit log Ravenna records creating, editing, scheduling, unscheduling, starting, canceling, and ending a review, and acting on its denials, in the organization [audit log](https://docs.ravenna.ai/documentation/platform/organizations/audit-log.md). ## Related topics - [Access reviews](https://docs.ravenna.ai/guides/playbooks/security/access-reviews.md) - [Complete an access review](https://docs.ravenna.ai/documentation/automate/access-management/access-reviews/reviewers.md) - [Access policies](https://docs.ravenna.ai/documentation/automate/access-management/policies.md) - [Setting up access management](https://docs.ravenna.ai/guides/how-to/setting-up-access-management.md) - [Employee offboarding](https://docs.ravenna.ai/guides/playbooks/hr/employee-offboarding.md) This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.