RITA — the access review assistant

01In a nutshell #sec_0da409c2

RITA answers in natural language the questions you ask about your reviews — where are my campaigns, who is late, what should I look at first — and never takes part in the decision.

02The problem #sec_f0c0c5cd

A recertification system produces a lot of information and very few answers. A reviewer with eighty requests spread over four campaigns must learn an interface to know where to start. An administrator who wants to know the completion rate of a campaign, identify late reviewers and check open disputes must visit three screens and cross the figures himself.

The question asked is always simple. It is the path to answering it that is not.

03The approach #sec_bfc3044f

RITA reads, aggregates and restores. She does not decide, and does not suggest a decision.

This is the founding constraint, and it is architectural — not a setting that could be loosened.

The reason lies in the very nature of the product. A recertification decision is only valuable if it can be attributed to a human who is accountable for it. The day an assistant proposes « I recommend that you revoke this access », the decision that follows becomes a validation, and the question « who decided? » no longer has a clear answer. The entire proof system collapses at this precise point.

RITA therefore has no tool in its toolkit capable of writing a decision. This is not an instruction given to the model, it is an absence of capacity. Added to this is a response policy that blocks recommendation formulations, and adversarial tests that verify this behavior continuously.

Three other principles follow from this:

1. Refusal is an acceptable answer. RITA prefers to say that she does not know rather than invent. A question outside her scope receives the list of what she can do.

2. She only sees what you see. Each answer is calculated in the context of the person asking the question — their reviews, their workspace, their role. No request crosses these limits, and an attempt to access an out-of-scope item fails without disclosing anything.

3. She displays names, never technical identifiers. An answer that cites people cites them as a colleague would.

04Three modes, an explicit choice #sec_85df34d2

RITA exists in three modes, and this choice is a governance decision, not a display preference.

The guided mode is not a degraded mode. It covers more than forty common questions, in both languages, with the same data and the same tools as the assisted mode. It is also the nominal path: it is the one that is developed and tested first, and the one to which the product automatically falls back in case of difficulty.

This design meets a frequent constraint: many organizations cannot — or not yet — transmit access governance data to a third-party AI service. They get a fully functional assistant, and prove it: in guided mode, no model call component is instantiated.

Who decides the mode

The setting is at two articulated levels: the subscription governs, the workspace chooses within the envelope.

The subscription sets the authorized modes — the AI-assisted mode requires an addendum of processing — the default mode, the telemetry policy and the provider. The workspace chooses its mode from those authorized.

An option prohibited by the subscription remains visible but locked, with the mention « managed by your subscription ». It is never hidden: a workspace administrator must be able to understand that the capacity exists and know who to contact.

05How it works #sec_f917126e

One router, two paths, one execution plan

Whatever the mode, a question produces a standardized execution plan:

1. An intent recognition engine analyzes the question — synonyms, French and English phrasing, parameter extraction (« for thirty days », « on the SharePoint campaign »).
2. In assisted mode, a recognized intention with a high confidence level bypasses the model: it is faster, more stable, and it costs nothing.
3. Otherwise, the model composes the response by calling the same tools, never the base directly.
4. Each tool call passes through a persona, permissions and delay check, and leaves a trace.

This unification has a practical consequence: switching from guided mode to assisted mode does not expand what RITA has access to. It only changes its ability to understand free formulations and cross-reference multiple responses.

What she knows how to do

More than forty intentions now cover two families:

Reviewer side — summary of their reviews, those that are late, what has changed since a date, what deserves priority attention, their received and issued disputes, their requests for advice, their requests for deletion, the deadline of a campaign, the breakdown by department or type, the explanation of a selected request (origin of access, members concerned, reason for non-compliance, history), a glossary.

Administrator side — what needs attention today, recent activity, active campaigns, their completion, those expired or stopped, late reviewers, deadlines, open disputes, workspace deletion requests, subscription credits and features, effective RITA mode.

The suggested questions displayed below the input area are produced by the catalog itself and filtered by persona: what is proposed is, by construction, what RITA can actually process.

The AI provider

In assisted mode, the provider is chosen by subscription. Several are supported, the call is direct, and the interface is identical regardless of the provider.

A platform circuit breaker allows a provider to be deactivated for all concerned subscriptions — in case of a communicated breach, for example. The effect is immediate and graduated: subscriptions fall back to guided mode, RITA continues to respond, and nothing more is transmitted.

The access keys to the providers are never stored in the database. The database carries the governance — who is entitled to what — never the secrets.

06What RITA will not do #sec_a069106f

This is the most important part of the file.

• Recommend a decision. Neither « I suggest you revoke », nor « this access seems unnecessary ». Tested continuously, including by explicit adversarial solicitations.
• Write a justification for you. A justification is the sentence that the auditor will read as yours.
• Act without confirmation. Every action goes through a prepare → reread → confirm → execute sequence, and execution remains a human gesture.
• See beyond your rights. The scope of the response is that of the person, not that of the model.
• Disclose sensitive values. When explaining a non-compliance, RITA restores the criterion and the expected, never the observed values, which contain identities.

07Traceability #sec_c949e169

RITA's activity is logged separately from the certification log. The two do not mix: a conversation is not an act of governance, and an act of governance is never justified by a conversation.

The following are retained: the recognized intention, the tools called, the actual mode and provider, the refusals opposed by the response policy. Unrecognized questions are counted as a footprint — their content is never retained — in order to improve the catalog without constituting a history of what users have requested.

Conversations are ephemeral by default.

08To remember #sec_094cf64f

RITA saves time on the path to information. It does not save any time on the decision — and that is deliberate.

A recertification system is worth the quality of human judgment it mobilizes. An assistant that pre-chews this judgment produces faster campaigns and weaker proofs. RITA is built on the opposite bet: by eliminating the time wasted searching, it makes available the time needed to think.