What REVIEWIT does not do

01Why this page exists #sec_c79cb7e3

A page that only lists capabilities leaves the reader to discover the limitations at the worst possible moment: after purchase, in the middle of a project. The following are not shortcomings awaiting correction — they are choices, and each has a reason that can be discussed.

02It does not decide for you #sec_aa01b8dc

REVIEWIT does not calculate whether an access should be retained. It gathers what is needed for someone to judge — the expected criterion, the observed state, the history — and it records the judgment.

A product that would automatically make decisions would produce revocations that no human would assume responsibility for. The day a legitimate access is abruptly revoked, the auditor's question is not "which algorithm?" but "who decided?" An answer is required.

RITA offers justification formulations; it does not choose the decision.

03An administrator does not approve anything #sec_5f692305

This is the most structuring limit, and it is deliberate. No administration surface — Workspace Center, Administration Center — allows for rendering a review decision. The public API does not allow it either: it exposes campaigns, decisions, evidence, and the audit trail in read-only mode.

Practical consequence: a campaign where reviewers do not respond cannot be "completed" by someone else. It ends incomplete, and the report states this.

04It does not revoke accesses on your behalf — not yet #sec_b81e2445

A revocation decision is a decision, not an execution. REVIEWIT records that access must be revoked; the actual revocation in the source system remains today an action performed by the client.

Connections already acknowledge their ability to remedy; the execution is announced, but not delivered. See the chapter [Release Notes](/release-notes/) for the actual status of this announcement — and not this page, which will age.

05It does not replace your identity provider #sec_8797aa4a

REVIEWIT does not manage accounts, passwords, or second factors. It relies on the client's identity provider — yours remains yours — and simply delegates authentication to it.

It does not create accesses either. It observes them, has them judged, and traces the decision.

06It does not remove anything from its audit trail #sec_413b59e6

An audit trail that allows deletions is no longer an audit trail. REVIEWIT's audit trail is written and not rewritten; corrections are added to it, they do not erase anything.

The trade-off is real: a typing error in a justification remains visible, and the correction appears alongside. This is the price of opposability.

07It does not compartmentalize documentation by client #sec_87f2b4f9

This portal is not segmented by tenant. There are only two content classes: public, and reserved for clients and partners. There is no third class, no role-based settings, no "visible only to you" page.

Content only enters the reserved space if it is assumed to be readable by both a client and a partner. Otherwise, it remains outside the portal.

08What it does not claim to be #sec_b08ed6ce

It is not a complete IGA: it does not provision, does not model business roles, does not manage access request workflows.

It is not a SIEM: it does not correlate security events in real time. On the other hand, it disseminates its own events to yours.

It is not a generic compliance tool: it does one thing — access recertification — and it proves it.

09To remember #sec_c4a7b9a9

The limits listed here are based on a single principle: what engages someone must be done by someone. The rest is a matter of roadmap, and the roadmap is read elsewhere.