> ## Documentation Index > Fetch the complete documentation index at: https://docs.altrum.ai/llms.txt > Use this file to discover all available pages before exploring further. # Access reviews > Review every key your organization holds, with when each was last used and what looks wrong, keep or revoke each one, and keep the decisions as evidence. Keys pile up: people move teams, projects end, a test key stays live. An access review goes through every [virtual key](/ai-gateway/virtual-keys.md) your organization holds, decides whether each one stays, revokes the rest, and keeps the decisions as evidence for an auditor. Run one each quarter. It is for owners, admins and Governance Leads when your organization has the AI Gateway. Auditors read every review and its decisions, without the spend, and change nothing. ## Start a review 1. Open **Access reviews** and choose **Start review**. 2. Give it a name. It starts as the quarter, such as **Q4 2026**, up to 100 characters. 3. Choose when it is **Due**, from today on. 4. Choose **Start review**. Starting a review takes a snapshot of every key your organization has: organization keys, AI system keys and personal keys. The snapshot does not change afterwards, so a review shows what was looked at on the day it started. A key made later waits for the next review. ## What each key shows | Column | What it is | | - | - | | **Key** | Its name and kind: Organization, AI system or Personal. | | **Owner** | The person who answers for it: the person behind a personal key, or the owner of the key's AI system. **left** beside the name means they are no longer an active member. | | **AI system** | The AI system the key belongs to, or **None**. | | **Last used** | The latest request or tool call made with it, or **Never**. | | **Spend, 90 days** | What it spent in the 90 days before the review started. | | **Flags** | What looks wrong with it, below. | | **Decision** | **Keep** or **Revoke**, and who decided. | ### Flags | Flag | Means | | - | - | | **Unused 90 days** | No request or tool call in 90 days. A key that was never used counts from when it was made. | | **Owner left** | The person behind a personal key, or the owner of an AI system's key, was removed or switched off as a member. | | **No expiry** | The key never expires. | | **Unattached** | An organization key with no AI system. | Choose a flag above the table to see only the keys with it. ## Keep or revoke Choose **Keep** or **Revoke** on a key, or tick several keys and choose **Keep** or **Revoke** above the table. A revoke asks first, says what stops working and takes an optional note, up to 500 characters: > Whatever uses it stops working at once, and requests with it are refused. This cannot be undone: a new key would be needed. A revoke happens straight away, through the same revoke as **Virtual keys**. If the AI Gateway cannot revoke a key, the key stays to decide and shows why, so a review cannot be completed while that key still works. Try again. A revoked key stays revoked. You can change a **Keep** to **Revoke** until the review is complete. ## Complete a review **Complete review** works once every key has a decision. A completed review cannot be changed. The list of reviews shows each one's progress while it is open, then how many keys were kept and revoked. A completed review is evidence: its decisions appear in the [compliance report](/compliance.md) of each AI system whose keys it covered, and in the organization report. ## The quarterly reminder In the last 7 days of each quarter, owners, admins and Governance Leads get a notification, **Access review due**, if no review was completed in that quarter. It is not on the Rules tab of [Alerts](/alerts.md) and cannot be switched off. Completing a review clears it. It does not email unless you switch it on under **Email settings** in the account menu. ## Who can do what | | Owner | Admin | Governance Lead | Auditor | Member | | - | - | - | - | - | - | | See access reviews | Yes | Yes | Yes | Without spend | No | | Start a review, keep or revoke keys, complete a review | Yes | Yes | Yes | No | No | Starting a review is limited to 20 an hour for each person, and decisions to 300 an hour. ## Recorded in the audit trail | Entry | When | | - | - | | **Started an access review** | A review starts. | | **Decided about keys in an access review** | Keys are kept or revoked. | | **Revoked a virtual key**, **Revoked a personal key** | Each key a review revoked. | | **Completed an access review** | A review is completed. | See the [audit trail](/audit-trail.md). This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.