Everything below exists in the product today. The IT Lead records who owns a service account and what your team decided about it. It does not connect to your directory, rotate secrets or disable accounts.
Upload a CSV of service accounts from any system. The importer shows a preview and marks rows with a missing identifier or source system before you commit anything. Rows that already exist are skipped and counted, so you can re-import an updated export safely.
Data stored: Per account: identifier, source system, description, privileged label and an optional owner email. Per import: file name, row count, error count and who ran it.
Example: Export service principals from your identity provider, import the file, and see which rows have errors before you confirm.
Every account can carry a nominated owner email, a purpose, a linked service and a review interval of 30, 90 or 180 days. The next review date is calculated from the interval. Accounts without an owner stay visible on the overview.
Data stored: Owner email, purpose, linked service, privileged label, review interval, next review date and a status such as owner nominated or needs investigation.
Example: Set svc-backup-veeam to owner j.keller@example.com with a 90 day interval. The overview lists it again when 90 days have passed.
A campaign groups accounts under a label and a due date. While it is a draft nothing is sent. When you publish it, each nominated owner receives an email with a personal link.
Data stored: Campaign label, start and due dates, status, and one attestation record per account with the owner email at the time of publishing.
Example: Create "Q4 service account review" for 40 accounts, due December 15, and publish it once the owners look right.
The link opens a short form where the owner confirms or rejects ownership without creating an account. The owner states what the account is used for, whether it is still needed and whether its access should be reviewed. A rejected or unsure answer marks the account as needs investigation.
Data stored: The answer (owns it, does not own it, not sure), purpose, still needed, access review flag, notes and the time of the response. Only a hash of the link token is stored, and the link expires 14 days after the campaign due date.
Example: j.keller opens the link, answers "I do not own this account" and adds the note "Moved to the platform team". The account shows up as needs investigation.
After an owner answers, a reviewer on your team accepts the answer, asks for clarification or reopens it. This keeps the owner statement and your team judgment as separate facts.
Data stored: Reviewer, decision, time of decision and the status of each attestation in the campaign.
Example: You accept the answer for svc-backup-veeam and reopen the one for svc-print-legacy because its purpose is vague.
A daily job finds owners who have not answered. They receive a reminder 7 days and 2 days before the due date, on the due date, and every week once overdue. Each reminder contains a fresh personal link.
Data stored: Every email in an outbox with status, recipient, subject and send time, so you can see what was sent.
Example: An owner who ignores the first email gets a reminder two days before December 15 with a new link.
Imports, owner changes, campaign publishing, owner answers and reviewer decisions are written to an activity log with the actor and the channel (web, email or MCP). Each campaign can be downloaded as a CSV file for auditors.
Data stored: Actor, action, entity, previous and new values and the time. The campaign CSV lists each account with owner, owner response, reviewer status and notes.
Example: Download "Q4 service account review" as CSV and attach it to your audit evidence folder.
A workspace admin creates a token in the app and connects an MCP client such as Claude Code or Cursor. The client can list accounts, find review gaps and read attestation history. It can create a draft campaign, but a person must publish it.
Data stored: Only a hash of each token, its label and when it was last used. Tokens are scoped to one workspace and can be revoked.
Example: Ask your assistant "Which privileged accounts have no owner?" and it calls list_owner_review_gaps for your workspace.
Each workspace is isolated by row-level security. Admins add existing users as members, subject to the member limit of the plan, and manage the subscription in the billing portal.
Data stored: Workspace name, timezone, memberships with an admin or member role, and the subscription status and plan from Stripe.
Example: Add a colleague who already has an account to your Team workspace, up to five members in total.