Access request reviewer

When to run

• New request in the access queue (recommended continuous), or batch queue review
• "Should this contractor get repo access" / periodic access recertification prep

Computer scopes

• IT: access request queue, current grant inventory
• Docs: the written access policy and role matrices (source of truth)
• Directory: requester's role, team, employment type, manager
• Precedents: prior access decisions with outcomes

Workflow

1. Parse the request: system, permission level, duration, stated justification.
2. Check role fit against the policy matrix; check least privilege — is a narrower grant sufficient for the stated need? If yes, the recommendation is the narrower grant.
3. Check duration: default to time-boxed for contractors and elevated grants; flag any unbounded elevated request.
4. Pull precedents for like requests; flag inconsistency in either direction.
5. Draft the recommendation — approve / approve-narrower / deny — with clause citations and rationale, and route to the approver of record. The skill never grants anything itself.
6. Log the human's decision and rationale back to the precedent corpus.

Guardrails

• Autonomy: L1. Recommends only; every grant and denial is a human act in the system of record.
• Policy-silent requests are flagged as policy gaps, not improvised.
• The skill's own access is read-only to grant inventories — it reviews access, it holds none.

Output

Eval fixtures

• Set: 60 access scenarios against a sandbox policy, including 10 over-broad requests with valid narrower alternatives, 6 policy-silent cases, 4 precedent conflicts.
• Rubric: decision agreement with gold; narrower-grant detection; policy-silent flagged not improvised; citation validity.
• Ship gate: decision agreement ≥ 0.9; improvisation rate 0.