> ## Documentation Index > Fetch the complete documentation index at: https://dev-docs.altrum.ai/llms.txt > Use this file to discover all available pages before exploring further. # Access reviews > Review every key your organization holds, with when each was last used and what looks wrong, keep or revoke each one, and keep the decisions as evidence. **Access reviews**, under **Prove** in the sidebar, is where owners and admins check who holds [virtual keys](/ai-gateway/virtual-keys), decide for each key whether it stays, and keep that decision as evidence for an auditor. It is for owners and admins when your organization has the AI Gateway. ## Start a review 1. Open **Access reviews** and choose **Start review**. 2. Give it a name. It starts as the quarter, such as **Q4 2026**, up to 100 characters. 3. Choose when it is **Due**, from today on. 4. Choose **Start review**. Starting a review takes a snapshot of every key your organization has: organization keys, AI system keys and personal keys. The snapshot does not change afterwards, so a review shows what was looked at on the day it started. A key made later waits for the next review. ## What each key shows | Column | What it is | | - | - | | **Key** | Its name and kind: Organization, AI system or Personal. | | **Owner** | The person who answers for it: the person behind a personal key, or the owner of the key's AI system. **left** beside the name means they are no longer an active member. | | **AI system** | The AI system the key belongs to, or **None**. | | **Last used** | The latest request or tool call made with it, or **Never**. | | **Spend, 90 days** | What it spent in the 90 days before the review started. | | **Flags** | What looks wrong with it, below. | | **Decision** | **Keep** or **Revoke**, and who decided. | ### Flags | Flag | Means | | - | - | | **Unused 90 days** | No request or tool call in 90 days. A key that was never used counts from when it was made. | | **Owner left** | The person behind a personal key, or the owner of an AI system's key, was removed or switched off as a member. | | **No expiry** | The key never expires. | | **Unattached** | An organization key with no AI system. | Choose a flag above the table to see only the keys with it. ## Keep or revoke Choose **Keep** or **Revoke** on a key, or tick several keys and choose **Keep** or **Revoke** above the table. A revoke asks first, says what stops working and takes an optional note, up to 500 characters: > Whatever uses it stops working at once, and requests with it are refused. This cannot be undone: a new key would be needed. A revoke happens straight away, through the same revoke as **Virtual keys**. If the AI Gateway cannot revoke a key, the key stays to decide and shows why, so a review cannot be completed while that key still works. Try again. A revoked key stays revoked. You can change a **Keep** to **Revoke** until the review is complete. ## Complete a review **Complete review** works once every key has a decision. A completed review cannot be changed. The list of reviews shows each one's progress while it is open, then how many keys were kept and revoked. A completed review is evidence: its decisions appear in the [compliance report](/compliance) of each AI system whose keys it covered, and in the organization report. ## The quarterly reminder In the last 7 days of each quarter, owners and admins get a notification, **Access review due**, if no review was completed in that quarter. It is not on the Rules tab of [Alerts](/alerts) and cannot be switched off. Completing a review clears it. It does not email unless you switch it on under **Email settings** in the account menu. ## Who can do what | | Owner | Admin | Member | | - | - | - | - | | See access reviews | Yes | Yes | No | | Start a review, keep or revoke keys, complete a review | Yes | Yes | No | Starting a review is limited to 20 an hour for each person, and decisions to 300 an hour. ## Recorded in the audit trail | Entry | When | | - | - | | **Started an access review** | A review starts. | | **Decided about keys in an access review** | Keys are kept or revoked. | | **Revoked a virtual key**, **Revoked a personal key** | Each key a review revoked. | | **Completed an access review** | A review is completed. | See the [audit trail](/audit-trail). This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.