REVIEWIT at a glance
01The problem #sec_39161269
In a medium-sized company, no one knows who has access to what.
This isn’t negligence; it’s a consequence. Access rights accumulate: they’re granted when someone joins, added for a project, or forgotten when a contractor leaves. Each action seems justified at the time. After three years, the sum of actions no longer makes sense, and no one has the context to decide.
Auditors ask a simple question: who approved this access, when, and on what basis? Most organizations have no answer. They have a spreadsheet.
02The solution #sec_f8e9f261
REVIEWIT organizes access recertification: at regular intervals, the people who know review the access rights they’re responsible for and decide whether to keep or remove them. The product doesn’t decide for them. It does three things.
It collects. It connects to Microsoft 365—and to other systems—and gathers the real-time state of access rights: who’s in which group, who owns which space, who hasn’t logged in for eighteen months.
It organizes. It breaks this mass into campaigns: a scope, a policy, reviewers, a deadline. Each reviewer receives only what they’re responsible for, and nothing more.
It proves. Each decision carries the name of the person who made it, the date, and the written justification. The audit trail is sealed: it can’t be rewritten.
03The promise and its condition #sec_52756ffe
REVIEWIT promises that every access decision can be traced to a person who reviewed, judged, and took responsibility.
This promise comes with a condition the product enforces everywhere: an administrator approves nothing. They organize, follow up, unblock, and report—but no administration interface allows them to make a review decision on behalf of a reviewer. The public API doesn’t allow it either. This isn’t a limitation that will be lifted in a future release: it’s the product’s reason for existing.
04What you’ll see on screen #sec_d4095e07
Three interfaces, one for each role.
| Interface | Who opens it | What you do there |
|---|---|---|
| REVIEW Center | The reviewer | Make decisions on the access rights you’re responsible for |
| Workspace Center | The workspace administrator | Launch and manage campaigns for an entity |
| Administration Center | The subscription administrator | Open workspaces, allocate resources |
They don’t overlap, and this is structural. See [Three interfaces, three roles](qui-fait-quoi).
05What this looks like in practice #sec_5ec09af0
A reviewer opens their queue on a Monday morning. They find, say, forty OneDrive resources marked as inactive for over twelve months. For each, the screen shows what the policy expected and what was observed—"activity in the last 12 months" versus "last activity on 07/05/2024 · 27 months ago".
They decide: keep, or confirm inactivity. They write why. They save.
Three months later, an auditor asks on what basis this person’s access was maintained. The answer exists, dated, signed, and no one had to reconstruct it.
06And what about AI? #sec_82afb6d4
RITA is the built-in assistant. It answers operational questions in natural language—"where are my campaigns?", "who’s behind schedule"—and suggests justification wording for reviewers who’re unsure how to phrase it.
It never decides. A justification suggestion remains just that: the reviewer accepts it, edits it, or ignores it, and their name is the one attached to the decision. See [RITA—the assistant for access reviews](rita).
07To remember #sec_840ec2f5
A product that organizes human judgment, and proves it. Three surfaces for three distinct business functions. And one rule that governs everything else: no one approves on behalf of someone else.