Small Team Access Review: Who Has Access to What and Why

Review accounts and permissions in a small organisation.

Added October 15, 2026. Written with AI assistance and checked for clarity and placeholders; not reviewed by a lawyer, accountant, clinician or other professional. How these prompts are made

The Open buttons send the prompt text as currently shown below to that site only when you click. Fill in the placeholders first.

[VERIFY] is an editorial flag, not a blank to fill. Wherever the prompt shows [VERIFY], check that item against a reliable source before you use it (what [VERIFY] means).

Run an access review for [ORGANISATION]. The list of systems and the people with accounts and their roles: [ACCESS_LIST]. People who have left or changed role: [LEAVERS_AND_MOVERS]. Shared accounts and how credentials are handled: [SHARED_ACCOUNTS]. Sensitive systems: [SENSITIVE_SYSTEMS].

Create a matrix of person by system showing role and access level, and mark excessive or unnecessary access, accounts of people who left, shared logins, accounts without two-step login, and accounts with no owner. Count findings by type with the arithmetic and sort by risk (high, medium, low) with a brief reason. Propose actions, owners and dates, a monthly joiner-mover-leaver routine, and a quarterly review checklist. Draft a message to account owners asking them to confirm that access is still needed.

Do not include any real credentials. Mark steps specific to a system as [VERIFY].

Add a worked finding list: 3 former staff with active accounts, 2 shared logins, 1 admin account with no owner, 5 accounts without two-step login, and a plan with owners and dates. Include a one-line request template to each manager: 'Please confirm the people and access levels below are still needed.'

Fill in before use

Optional: type your details and the prompt above updates. Nothing is saved or sent.

Replace each bracketed placeholder with your own details, then paste into Any AI or another assistant.