Permission reviews aren’t a judgment call. They’re list-matching, and that’s the part worth automating
Bodil Biering
A permission review sounds like a judgment call: should this person still have access? In practice, most of the work isn’t the judgment call at all. It’s logging into each system, checking who’s on the user list, cross-referencing that against who’s actually still employed, flagging anyone who shouldn’t be there anymore, and then uploading proof that you did it.
That’s not compliance thinking. That’s matching lists.
Which is exactly the kind of work an AI connector with browser access could plausibly take over: go into a tool like Atlassian, screenshot the current users, note how many have admin rights, compare that against a separate source of truth for who’s actually employed, and flag anyone in the first list who isn’t in the second. Then turn that into a small report and upload it as evidence.
Worth being honest about where this stands, though: it hasn’t been tested end to end. The connector is brand new, and the plan is to start using it now and see which cases it actually turns out to be most helpful for - not to assume it works because it sounds plausible.
Still, the reframe is useful on its own. The painful part of a permission review isn’t deciding the rule. It’s the manual cross-checking required to prove the rule was followed. That’s a narrower problem than “compliance” sounds like - and narrower problems are the ones worth automating first.
