Access reviews

Keys pile up: people move teams, projects end, a test key stays live. An access review goes through every virtual key your organization holds, decides whether each one stays, revokes the rest, and keeps the decisions as evidence for an auditor. Run one each quarter. It is for owners, admins and Governance Leads when your organization has the AI Gateway. Auditors read every review and its decisions, without the spend, and change nothing.

​

Start a review

1. Open Access reviews and choose Start review.
2. Give it a name. It starts as the quarter, such as Q4 2026, up to 100 characters.
3. Choose when it is Due, from today on.
4. Choose Start review.

Starting a review takes a snapshot of every key your organization has: organization keys, AI system keys and personal keys. The snapshot does not change afterwards, so a review shows what was looked at on the day it started. A key made later waits for the next review.

​

What each key shows

​

Flags

Choose a flag above the table to see only the keys with it.

​

Keep or revoke

Choose Keep or Revoke on a key, or tick several keys and choose Keep or Revoke above the table. A revoke asks first, says what stops working and takes an optional note, up to 500 characters:

Whatever uses it stops working at once, and requests with it are refused. This cannot be undone: a new key would be needed.

A revoke happens straight away, through the same revoke as Virtual keys. If the AI Gateway cannot revoke a key, the key stays to decide and shows why, so a review cannot be completed while that key still works. Try again. A revoked key stays revoked. You can change a Keep to Revoke until the review is complete.

​

Complete a review

Complete review works once every key has a decision. A completed review cannot be changed. The list of reviews shows each one’s progress while it is open, then how many keys were kept and revoked. A completed review is evidence: its decisions appear in the compliance report of each AI system whose keys it covered, and in the organization report.

​

The quarterly reminder

In the last 7 days of each quarter, owners, admins and Governance Leads get a notification, Access review due, if no review was completed in that quarter. It is not on the Rules tab of Alerts and cannot be switched off. Completing a review clears it. It does not email unless you switch it on under Email settings in the account menu.

​

Who can do what

Starting a review is limited to 20 an hour for each person, and decisions to 300 an hour.

​

Recorded in the audit trail

See the audit trail.