> For the complete documentation index, see [llms.txt](https://docs.harmony.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.harmony.io/ai-agents/access-control/privileged-access-review-agent.md). # Privileged Access Review Agent The Privileged Access Review agent automates the full lifecycle of elevated-access audits across your connected applications. Instead of running manual reviews on a schedule, the agent continuously monitors which users hold admin or elevated permissions in each managed application, reaches out to the right owner for a decision, and acts on that decision automatically - all without requiring you to build or maintain a separate workflow. This article explains how the agent works, how to configure it, and what happens at each stage of the review cycle. *** ### How It Works The Privileged Access Review agent runs on a recurring schedule you define. Each cycle follows these steps: 1. **Discovery** - The agent scans each connected application and identifies every user who holds admin or elevated permissions at the time of the review. 2. **Owner resolution** - For each application, the agent looks up the configured application owner. If no owner is set, your IT admin is used as the fallback recipient. 3. **Review request** - The agent sends the owner an interactive review request over Slack, Teams, or email. The request lists each flagged user along with their current role or permission level. 4. **Decision collection** - For every user on the list, the owner selects one of three actions: * **Approve** - the user retains their current access with no changes. * **Request removal** - the user's elevated access is revoked. * **Request role change** - the user's role is adjusted to a lower permission level. 5. **Execution** - The agent applies approved removal or role-change decisions directly in the connected application. 6. **Logging** - Every decision - whether approve, remove, or change - is recorded automatically in the audit log for compliance and reporting purposes. *** ### Supported Notification Channels Review requests can be delivered through any of the following channels: * **Slack** - sent as an interactive message to the application owner's Slack account. * **Microsoft Teams** - sent as an adaptive card in the owner's Teams account. * **Email** - sent as a structured email with inline action links. The channel used for a given review is determined by the notification preferences configured in your Harmony workspace. *** ### Configuring the Agent #### Prerequisites Before enabling the Privileged Access Review agent, make sure you have: * At least one application connected to Harmony through an integration. * The relevant application owners assigned within Harmony, or an IT admin fallback address configured. * Notification channel credentials set up (Slack OAuth, Teams connector, or SMTP settings). #### Setting Up a Review 1. Navigate to **AI Agents** in the Harmony console and open the **Privileged Access Review** agent. 2. Select the applications you want to include in the review scope. 3. Set the review frequency - for example, weekly, bi-weekly, or monthly. 4. Confirm or update the application owner for each selected application. Where no owner is assigned, verify that your IT admin fallback is correct. 5. Choose the notification channel through which review requests will be sent. 6. Save and activate the agent. Once activated, the agent begins its first scan at the next scheduled interval. *** ### Review Request Experience When the agent sends a review request, the recipient sees a structured list of users with elevated permissions in the application. Each entry includes: * The user's name and email address. * Their current role or permission level. * Action buttons or links to **Approve**, **Request Removal**, or **Request Role Change**. Owners can act on each user individually. The agent waits for responses and applies decisions as they come in. If a deadline or reminder policy is configured, the agent can follow up automatically with the owner if responses are pending. *** ### Access Revocation and Role Changes When an owner selects **Request Removal** or **Request Role Change** for a user, the agent executes the action directly through the connected application's integration. You do not need to intervene manually. * **Removal** deprovisions the user's elevated permissions in the target application. * **Role change** reassigns the user to the lower-privilege role specified during the decision. Both actions take effect as soon as the agent processes the owner's response. *** ### Audit Logging Every action taken by the Privileged Access Review agent is captured in the Harmony audit log. Log entries include: * The application reviewed. * The user whose access was evaluated. * The decision made (approved, removed, or role changed). * The identity of the owner who made the decision. * The timestamp of the decision and the timestamp of execution. These records are available for export and can be used to satisfy compliance requirements for privileged access management audits. *** ### Fallback Behavior If no application owner is configured for a given application, all review requests for that application are routed to the designated IT admin. This ensures no application is skipped during a review cycle, even if ownership has not yet been assigned. It is recommended that you assign a dedicated owner to each application to keep review requests targeted and reduce the volume of notifications sent to your IT admin. *** ### Best Practices * **Assign application owners explicitly** for every managed application so that review requests reach the most relevant person rather than defaulting to IT admin. * **Start with a longer review interval** (monthly) when first enabling the agent, then shorten the interval once owners are familiar with the process. * **Review the audit log after each cycle** to confirm that all removal and role-change actions were executed successfully. * **Use Slack or Teams** as your notification channel when possible - interactive messages in those platforms tend to get faster responses than email-based action links. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://docs.harmony.io/ai-agents/access-control/privileged-access-review-agent.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.