performing-access-recertification-with-saviynt
Lets your agent manage access permissions in systems. Useful for ensuring only authorized people have access and for complying with rules.
What it does
This tool helps organize and run reviews of system access. It checks if people have the right permissions, removes unnecessary access, and ensures everything complies with security and audit rules.
When to use it
- ✓When starting a new access review for users or permissions.
- ✓When needing to fix access that was reviewed and found to be inappropriate.
- ✓To generate security and compliance reports for audits.
Example of what to ask your AI
“Set up an access review campaign for all sales team users, focusing on financial data access permissions, with a 15-day deadline.”
Want more? Open the sections below.
How to use
The easiest way: copy the message below and paste it into Claude, ChatGPT, Cursor or any AI. It reads the skill and follows the instructions.
Skill link
Ready-to-paste message
How it works
You define the review parameters, like who reviews, what will be reviewed, and when. Then, the tool sends notifications and collects decisions from reviewers to ensure access is correct.
Installation
Easiest way: copy the skill link and paste it into Claude, ChatGPT or Cursor asking it to follow the instructions.
In the terminal (Claude Code, Codex, Cursor), in your project folder:
npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill performing-access-recertification-with-saviyntOr download just the file:
curl -L https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/main/skills/performing-access-recertification-with-saviynt/SKILL.md -o SKILL.mdTechnical content (original SKILL.md)
Original text by the author, straight from GitHub.
Performing Access Recertification with Saviynt
Overview
Access recertification (also called access certification or access review) is a periodic process where designated reviewers validate that users have appropriate access to systems and data. Saviynt Enterprise Identity Cloud (EIC) automates this process through certification campaigns that present reviewers with current access assignments and collect approve/revoke/conditionally-certify decisions. Campaigns can be triggered on schedule (quarterly, semi-annually), event-driven (department transfer, role change), or on-demand. Saviynt provides intelligence features including risk scoring, usage analytics, and peer-group analysis to help reviewers make informed decisions.
When to Use
- When conducting security assessments that involve performing access recertification with saviynt
- When following incident response procedures for related security events
- When performing scheduled security testing or auditing activities
- When validating security controls through hands-on testing
Prerequisites
- Saviynt Enterprise Identity Cloud (EIC) tenant with admin access
- Identity data synchronized from authoritative sources (HR, AD, cloud)
- Entitlement data imported from target applications
- Certifier roles assigned (managers, application owners, data owners)
- Campaign templates defined for each certification type
Core Concepts
Campaign Types
| Type | Scope | Trigger | Certifier |
|---|---|---|---|
| User Manager | All access for users under a manager | Scheduled (quarterly) | Direct manager |
| Entitlement Owner | All users with a specific entitlement | Scheduled (semi-annually) | Entitlement/app owner |
| Application | All access to a specific application | Scheduled | Application owner |
| Role-Based | All users assigned to a specific role | Scheduled | Role owner |
| Event-Based | Users whose attributes changed | Attribute change trigger | New manager |
| Micro-Certification | Single user, single entitlement | On-demand | Manager or owner |
Certification Decisions
| Decision | Effect | Use Case |
|---|---|---|
| Certify (Approve) | Access maintained | Access is still required |
| Revoke | Access removal ticket created | Access no longer needed |
| Conditionally Certify | Access maintained with conditions | Access needed temporarily, review again |
| Delegate | Reassign to another certifier | Certifier lacks knowledge to decide |
| Abstain | No decision recorded | Conflict of interest |
Campaign Lifecycle
CONFIGURATION → PREVIEW → ACTIVE → IN PROGRESS → COMPLETED → REMEDIATION
│ │ │ │ │ │
│ │ │ │ │ └── Revoke tickets
│ │ │ │ │ executed
│ │ │ │ │
│ │ │ │ └── All decisions
│ │ │ │ collected
│ │ │ │
│ │ │ └── Certifiers reviewing
│ │ │ and making decisions
│ │ │
│ │ └── Campaign launched,
│ │ notifications sent
│ │
│ └── Read-only preview for validation
│
└── Campaign parameters defined
Workflow
Step 1: Configure Campaign Template
In Saviynt Admin Console:
- Navigate to Certifications > Campaign > Create New Campaign
- Define campaign parameters:
| Parameter | Value |
|---|---|
| Campaign Name | Q1 2025 Manager Access Review |
| Campaign Type | User Manager |
| Description | Quarterly review of all user access |
| Certifier Type | Manager (dynamic - user's direct manager) |
| Secondary Certifier | Application Owner (fallback if manager unavailable) |
| Due Date | 14 days from launch |
| Reminder Schedule | Day 7, Day 10, Day 13 |
| Escalation | Auto-revoke on Day 15 if no decision |
Configure scope filters:
- Include: All active users
- Exclude: Service accounts, break-glass accounts
- Application filter: All connected applications
Configure intelligence features:
- Enable risk scoring (high-risk entitlements highlighted)
- Enable usage data (last access date shown)
…
FAQ
What is an access recertification campaign?
It's a process where designated individuals (like managers or system owners) review and approve or remove user access to systems and data.
What types of reviews can be done?
Reviews can be for user access, specific permissions, entire applications, or based on role changes or events.
What happens if access is found to be inappropriate?
If access is revoked, a ticket to remove that permission is automatically created to ensure the change is made.
Details
Original description by the author
Configure and execute access recertification campaigns in Saviynt Enterprise Identity Cloud to validate user entitlements, revoke excessive access, and maintain compliance with SOX, SOC 2, and HIPAA. Use when launching or managing certification campaigns for users/entitlements, remediating access review findings, or documenting identity governance evidence for an audit.
Popularity
- GitHub stars
- 35k
- Ranking position
- #6006
- License
- Apache-2.0
- Updated
- 8/31/2026
Comments
- …
More skills from this repository
abusing-dpapi-for-credential-access
Gives your AI agent ready-made instructions for a specific task, so it does it better and faster.
mukul975/Anthropic-Cybersecurity-Skills
abusing-shadow-credentials-for-privesc
Teaches your AI agent to write clear, well-structured text.
mukul975/Anthropic-Cybersecurity-Skills
achieving-cmmc-level-2-compliance
Helps your agent prepare an environment for CMMC Level 2 compliance. It implements security requirements and manages necessary documentation.
mukul975/Anthropic-Cybersecurity-Skills
acquiring-disk-image-with-dd-and-dcfldd
Helps your agent create exact copies of hard drives. This is useful for ensuring no information is lost or altered during investigations.
mukul975/Anthropic-Cybersecurity-Skills
Similar skills
dashboard-builder
Helps your agent create useful monitoring dashboards. It turns data into charts that answer important system questions.
affaan-m/ECC
dev-team
Simulates a collaborative development team where different roles respond to a problem together. It's useful for getting multiple perspectives without manually switching agents.
affaan-m/ECC
ecc-council
Has your agent convene a four-voice council for difficult decisions. It's useful when there are multiple good options and debate is needed before choosing.
affaan-m/ECC