From asi
Conducts systematic reviews of privileged accounts to validate access rights, identify excessive permissions, and enforce least privilege across PAM infrastructure. Useful for compliance audits and security assessments.
npx claudepluginhub plurigrid/asi --plugin asiThis skill uses the workspace's default tool permissions.
Privileged Account Access Review is a critical identity governance process that validates whether users with elevated permissions still require their access. This review covers domain admins, service accounts, database administrators, cloud IAM roles, and application-level privileged accounts. Regular access reviews are mandated by SOC 2, PCI DSS, HIPAA, and SOX compliance frameworks, typically...
Conducts privileged account access reviews to validate rights, detect excessive permissions, enforce least privilege, and ensure compliance in PAM, IAM, and cloud environments.
Conducts systematic reviews of privileged accounts in PAM setups, verifying access permissions, identifying excesses, and enforcing least privilege across AD, AWS, Azure, GCP, and databases. Useful for compliance audits.
Audits service accounts across Active Directory, AWS, Azure, GCP, databases, and apps to identify orphaned, over-privileged, and non-compliant ones. Useful for security assessments, compliance audits, and incident response.
Share bugs, ideas, or general feedback.
Privileged Account Access Review is a critical identity governance process that validates whether users with elevated permissions still require their access. This review covers domain admins, service accounts, database administrators, cloud IAM roles, and application-level privileged accounts. Regular access reviews are mandated by SOC 2, PCI DSS, HIPAA, and SOX compliance frameworks, typically required quarterly for high-privilege accounts.
| Category | Examples | Risk Level | Review Frequency |
|---|---|---|---|
| Domain Admins | Enterprise Admin, Domain Admin, Schema Admin | Critical | Monthly |
| Service Accounts | SQL service, backup agents, monitoring agents | High | Quarterly |
| Cloud IAM | AWS root, Azure Global Admin, GCP Owner | Critical | Monthly |
| Database Admin | DBA accounts, sa/sys accounts | High | Quarterly |
| Application Admin | App admin roles, API keys with admin scope | Medium | Semi-annually |
| Emergency/Break-glass | Firecall accounts, emergency access | Critical | After each use |
DISCOVER VALIDATE REMEDIATE MONITOR
│ │ │ │
├─ Enumerate all ├─ Verify business ├─ Remove excess ├─ Continuous
│ privileged accounts │ justification │ privileges │ monitoring
│ │ │ │
├─ Identify orphaned ├─ Confirm account ├─ Disable orphaned ├─ Anomaly
│ accounts │ ownership │ accounts │ detection
│ │ │ │
├─ Map permissions to ├─ Check compliance ├─ Enforce password ├─ Session
│ business roles │ with policies │ rotation │ recording
│ │ │ │
└─ Classify by risk └─ Review last usage └─ Implement JIT └─ Audit
level and activity access logging
Enumerate all privileged accounts across the environment:
Active Directory:
Cloud Platforms:
iam:* permissionsDatabases:
Each privileged account must be evaluated against:
For each account, the designated reviewer must:
Decision matrix:
| Condition | Action |
|---|---|
| Active user, justified privilege | Certify - maintain access |
| Active user, excessive privilege | Remediate - reduce to least privilege |
| Inactive > 90 days | Disable account, notify owner |
| No owner identified | Disable account, escalate to security |
| SoD conflict detected | Remediate - reassign or add compensating controls |
| Break-glass account | Verify last use was authorized, reset credentials |
After reviews are completed:
Generate review reports including: