Run your first access review

Review the test identity and Grant established by your first lifecycle policy. Create a small certification campaign, check its scope and reviewers, then record a Keep decision and export the evidence. A Keep decision leaves the policy-backed access in place.

Use access already visible in Owlie and choose a reviewer who can sign in. You need permission to manage review campaigns. If you override the inherited review policy, you also need permission to manage review policies. The person making a decision must be the assigned reviewer or otherwise authorized for that review step.

Create a certification campaign

1. Open Admin > Governance > Campaigns and choose Create campaign.
2. Select Certification to record a reviewer's access decision and export its evidence. Attestation lets a person extend needed access or let it expire; it does not support certification evidence export.
3. Give the campaign a recognizable test name and description. Leave Due offset empty if this short test does not need a due date.
4. Narrow Who to your pilot identity and What to the target resource. Under Grant types, select Grants only for the entitlement you established.
5. Use the inherited review policy unless the test specifically needs different reviewers. If you override it, select a reviewer who is eligible and available, and use Test policy against a representative Grant before saving.
6. Create the campaign, then open its draft preview.

The scope selects recorded access, not merely resource definitions. If the preview returns no items, confirm that the pilot identity holds matching access and that Who and What select it.

Screenshot placeholder: Draft campaign preview. Show the test identity and Grant. Annotate Items in scope, Reviewer load, unresolved reviewer entries, and Launch campaign.

Check the access and reviewers

Before launch, compare the preview with the access you selected:

• Items in scope is nonzero and small enough to inspect individually.
• The identity, resource, and Grant examples are the expected access records.
• Reviewer load names the intended reviewer and shows a plausible new-item count.
• No reviewer is shown as Unresolved. Fix the campaign or inherited policy before launch if manager, owner, group, or function resolution cannot produce an eligible reviewer.
• The preview is not capped. Owlie refuses to launch a scope above the campaign item limit rather than silently truncating it.

You cannot return a launched campaign to Draft. Cancellation stops outstanding work but keeps decisions already made.

Choose Launch campaign after checking the preview. Owlie creates one review item for each matching Grant and notifies the assigned reviewers.

Make and verify one decision

Sign in as the resolved reviewer and open Reviews. Select the pilot item and choose Keep after confirming its access is appropriate. Enter a reason when the effective policy requires one, then choose Submit decisions.

Return to the campaign run and open the item timeline. Check the reviewer, decision, reason when supplied, and decision time. Keep completes the review without removing access.

If you also test a revoke

Use separate, low-risk access for a removal test. Do not revoke the policy-backed pilot Grant unless you also intend to change the policy that requires it. A review decision does not override that continuing source of access. If a policy or workflow blocks the revoke, an administrator with remediation permission must change the source and record what they changed before removal can proceed.

Check the review's remediation mode before testing: it may be automatic, manual, or disabled. Manual remediation needs an administrator's action; disabled remediation will not start a removal merely because a reviewer chose Revoke.

For a revoke decision, monitor Remediation separately from the review decision:

• Needs remediation means a revoke decision exists but cleanup has not started.
• In progress means removal has been submitted to provisioning or its fulfillment path.
• Completed means remediation processing finished. Inspect the remediation outcome: access may have been removed or retained because another valid source still supports it.
• Failed requires correction and retry; the decision remains recorded.

Check both the remediation outcome and current assigned access before reporting that access was removed. Review decisions can be complete while removal is still pending.

Export the decision

Open the decided certification item and choose Export evidence. Check that the evidence records the expected identity, access, reviewer, and decision.

Use the access review configuration reference when designing recurring scope, reviewer stages, timing, escalation, and reason requirements.