The problem

Assembling production access evidence for security reviews or audits is a manual, error-prone grind. Scattered logs, Slack approvals, and ticket timestamps often conflict, leaving gaps in the narrative of who did what and when.

What it does

• Reconstructs a traceable timeline of access requests, approvals, activity, and revocation.
• Maps requested permissions against actual provisioned roles and executed commands.
• Identifies gaps such as pre-approval activity, missing MFA, or unrevoked tokens.
• Differentiates between customer approval, internal authority, and break-glass emergency access.
• Generates a structured review packet with source registers and attribution maps.

Why this beats prompting it yourself

General-purpose prompts often conflate role removal with session termination or fail to maintain the distinction between a request and an approval. This skill enforces a neutral, evidence-based workflow that refuses to invent data or draw unauthorized compliance conclusions, ensuring the final packet stands up to professional review.

Use cases

• Generating a handoff packet for incident response or security postmortems.
• Reconciling support team impersonation sessions with customer approvals.
• Investigating privileged access gaps where shared accounts or contractors were used.
• Pre-audit preparation to identify missing evidence before a formal compliance review.

Known limitations

This tool does not connect to live systems or identity providers. It relies entirely on logs and materials you provide via files or the Read tool.