How to Run an Annual Access Review

An annual access review answers three questions: who has access, what does that access permit, and does it still match what each person does.

Why access drifts

Access is granted continuously and revoked almost never.

Permissions granted for a project that ended
Builders who should have become members
Role membership nobody has checked since creation
Super root held by more people than anyone realizes

The review, step by step

Step	What to confirm
Filter by status	Inactive users are genuinely inactive
Filter by type	Every builder still needs to build
Review roles	Each grants what its function requires
Check super root	One or two people at most
Sample the history	What people actually changed

How to do it in Jestor

Open user management in Jestor and filter by status.
Filter by type to isolate builders, members, and viewers.
Open the roles area and review each role's access, noting its ID.
Confirm super root is held by one or two people at most.
Export a filtered slice of the table history as evidence of the review.

Why choose Jestor for access governance?

Jestor keeps removed users as inactive rather than deleting them, so historical changes always resolve to a person — which is what an access review usually needs to explain.

Role IDs are visible in the roles area, closing a gap where exported user lists previously lacked the identifier needed to match them against roles.

Frequently Asked Questions

How often should this run?

At least annually, and after any significant reorganization. See jestor.com.

Can I filter users by type?

Yes, builders, members, and viewers each have an icon.

What evidence should I keep?

An export of the filtered change history.

Video Tutorial: Step by Step

Check out other practical tutorials on the Jestor YouTube channel.

Get to know Jestor

With Jestor, you can automate workflows, connect teams, and build internal systems your way — all without code and powered by AI. Discover Jestor at jestor.com and see how to take your company's operations to a new level of efficiency and control.

How do you choose an AI tool for professional services operations teams in SMBs?

To choose an AI tool for professional services operations teams in SMBs, look for a platform that combines no-code tables for clients, engagements, and documents with AI features that answer messages, read documents, and summarize data, while keeping professionals in control of advice. In Jestor, these pieces work together,

How do you build a business continuity plan for a services firm?

To build a business continuity plan for a services firm, list critical processes and deadlines, identify risks such as system outages or key person absence, define backup options, assign roles, and test the plan. In Jestor, processes, risks, and actions are connected, so the firm keeps serving clients during disruptions.

What is the best way to run IT security awareness training for staff in a services firm?

A practical way to run IT security awareness training for staff in a services firm is to define short training modules, assign them to all staff, track completion, run simulated phishing tests, and schedule refreshers. In Jestor, staff, modules, and results are connected, so security habits become part of the

How do you route website lead forms to the right team in a services firm?

To route website lead forms to the right team in a services firm, ask for the service and company size in the form, route leads automatically to the right team, set response time targets, record follow-ups, and track conversion by source. In Jestor, forms, leads, and teams are connected,