Least privilege that stays current.
Access granted is access forgotten, unless something flags it. Give every grant an expiry and Driply flags it the moment it lapses, then keeps a live, exportable record, so stale access surfaces on its own and the periodic review reads an accurate picture instead of a scramble.
- Beverly Crusher → Figmaexpires in 12d
- Geordi La Forge → GitHubrenewed · 90d
- Tasha Yar → AWSexpired · removed
A user access review asks a simple question: does each person still need the access they have? That is painful to answer when access is granted and forgotten.
Driply keeps least privilege visible by giving every grant an expiry: when it lapses, Driply automatically flags the grant and alerts you to revoke it, so stale access surfaces instead of sitting unnoticed. Paired with the live, append-only record you review against, the periodic review becomes a confirmation of an accurate picture rather than a fire drill.
Access with an expiry
Grants are issued with an expiry rather than living forever. When a temporary or contractor grant lapses, Driply flags it and alerts you to remove it, so stale access surfaces instead of quietly accumulating. Driply records the expiry and prompts the revoke; your team makes the actual change in the tool.
A review you read, not reconstruct
Because expiries flag stale access as grants lapse and every decision is on the live record, the periodic review is a read of an accurate picture, confirm what’s there, revoke what isn’t needed, export the result, instead of rebuilding months of changes under deadline. On Business and up, run it as a guided review campaign: certify, flag, or remove each grant on a recurring schedule, with a signed-off evidence pack at the end.
Every action recorded
Expiries and revokes land in the append-only log as they happen, so when you run a review, the actions you take are captured as evidence, ready to export.
From quarter-end scramble to a steady state
When expiries flag access the moment a grant lapses, the picture never drifts far from least privilege, so the periodic review SOC 2 and ISO 27001 ask for becomes a quick confirmation of an already-accurate state, not weeks of reconstruction. Tool owners can carry their share, reviewing access for the tools they own.
On Business and up, the periodic review runs as a guided, recurring campaign: walk each grant tool by tool, certify / flag / remove, and export a signed-off PDF or CSV evidence pack, recertification as a structured workflow, not a spreadsheet. As with everything in Driply, reviews document and prove access. The record reflects decisions and expiries; the actual change in each tool is performed by your team, and Driply never writes to your tools. Read-only connectors that confirm each account still exists, to reconcile against your register, are on the roadmap; even then Driply will only ever verify, never provision.
The result, Least privilege as a steady state, not an annual cleanup.
Questions, answered.
- What is a user access review?
- A periodic check that each person still needs the access they hold. Driply keeps it current by giving every grant an expiry that flags stale access when it lapses, and recording every grant on a live, exportable log, so the review reads an accurate picture instead of accumulating drift. On Business and up, you can run it as a guided, recurring review campaign that exports a signed-off evidence pack.
- Does access expire automatically?
- Grants carry an expiry, and when it passes Driply automatically flags the grant and alerts your admins to revoke it, so stale access surfaces on its own. Driply surfaces it; it doesn’t silently remove access or reach into the tool. Your team makes the actual change, and Driply records it (Driply never writes to your tools).
- Do access reviews produce audit evidence?
- Yes. Expiries and revokes are written to the append-only log as they happen, and the actions you take in a review export as branded PDF or CSV for SOC 2 and ISO 27001.