Skip to main content
Access reviews, under Prove in the sidebar, is where owners and admins check who holds virtual keys, decide for each key whether it stays, and keep that decision as evidence for an auditor. It is for owners and admins when your organization has the AI Gateway.

​
Start a review

  1. Open Access reviews and choose Start review.
  2. Give it a name. It starts as the quarter, such as Q4 2026, up to 100 characters.
  3. Choose when it is Due, from today on.
  4. Choose Start review.
Starting a review takes a snapshot of every key your organization has: organization keys, AI system keys and personal keys. The snapshot does not change afterwards, so a review shows what was looked at on the day it started. A key made later waits for the next review.

​
What each key shows

​
Flags

Choose a flag above the table to see only the keys with it.

​
Keep or revoke

Choose Keep or Revoke on a key, or tick several keys and choose Keep or Revoke above the table. A revoke asks first, says what stops working and takes an optional note, up to 500 characters:
Whatever uses it stops working at once, and requests with it are refused. This cannot be undone: a new key would be needed.
A revoke happens straight away, through the same revoke as Virtual keys. If the AI Gateway cannot revoke a key, the key stays to decide and shows why, so a review cannot be completed while that key still works. Try again. A revoked key stays revoked. You can change a Keep to Revoke until the review is complete.

​
Complete a review

Complete review works once every key has a decision. A completed review cannot be changed. The list of reviews shows each one’s progress while it is open, then how many keys were kept and revoked. A completed review is evidence: its decisions appear in the compliance report of each AI system whose keys it covered, and in the organization report.

​
The quarterly reminder

In the last 7 days of each quarter, owners and admins get a notification, Access review due, if no review was completed in that quarter. It is not on the Rules tab of Alerts and cannot be switched off. Completing a review clears it. It does not email unless you switch it on under Email settings in the account menu.

​
Who can do what

Starting a review is limited to 20 an hour for each person, and decisions to 300 an hour.

​
Recorded in the audit trail

See the audit trail.