Employees request access to AI chatbot platforms during onboarding, then change roles, leave the company, or spin up personal API keys that outlive their projects. Six months later, a former contractor's API key still calls your production AI API integration. Identity teams run quarterly SaaS reviews for Salesforce and Slack, yet AI tool accounts sit outside the cadence because nobody mapped them to the access governance program.
An AI access review policy defines how often your organization validates who can use AI tools, what permissions they hold, and whether access still matches job function. This guide helps IAM administrators, security engineers, and data owners implement review cadences that satisfy SOC 2 CC6.3 logical access requirements and customer security questionnaire expectations. The policy covers human users, groups, service accounts, and API credentials across approved and shadow AI platforms.
Scope: Users, Groups, API Keys, Integrations
Include in every AI access review cycle: named user accounts, role-based groups, API keys and service tokens, OAuth application grants, SSO federated identities, and third-party integrations that call AI endpoints on behalf of users or systems. Excluding any credential type creates an audit gap. Map each AI platform in your tool inventory register to the identity sources that provision access.
| Access object | Review source | Default cadence |
|---|---|---|
| Named user accounts | SSO logs, vendor admin console export | Quarterly |
| Role groups | IdP group membership, RBAC matrix | Quarterly |
| API keys | Secrets manager, vendor key registry | Monthly for production keys |
| OAuth grants | Google/Microsoft admin consent logs | Quarterly |
| Integrations | CMDB, integration platform audit | Semi-annual |
Tiered Review Cadence
Apply stricter cadences to higher-risk platforms: monthly reviews for production AI API keys processing customer data; quarterly for team AI chatbot seats; semi-annual for individual productivity assistants on public data only. Document tier assignments in the access review calendar. Risk tier changes from the AI inventory register should automatically adjust review frequency.
Shadow AI Inclusion
When shadow AI discovery identifies unapproved platforms with active accounts, add them to the next review cycle with elevated scrutiny until remediated or formally approved. Shadow accounts discovered through network logs get reviewed immediately, not deferred to the quarterly batch. Remediation options include access revocation or fast-track approval with compensating controls.
Reviewer Assignment by Data Owner
Assign reviewers by data ownership: the business owner or their delegate attests that each user still requires access; technical owners validate API keys and service accounts; security reviews admin and privileged roles independently. Managers should not review their own access. Segregation of duties prevents rubber-stamp approvals during busy quarter closes.
Reviewer RACI
| Role | Reviews | Cannot approve |
|---|---|---|
| Data owner | User seats in their domain | Own access |
| Engineering lead | API keys, service accounts | Keys they created |
| Security team | Admin roles, break-glass accounts | N/A (independent review) |
| IAM operations | Process completion, evidence export | Business justification decisions |
Attestation Workflow
Reviewers receive a scoped list of access objects with last-login date, permission level, and data classification; they certify retain, modify, or revoke for each entry within ten business days. Non-response escalates to the reviewer's manager, then to security for automatic revocation after fifteen business days. Automatic revocation applies to stale API keys with no attestation, not to user seats without manager response (those escalate first).
Remediation SLAs for Findings
Revoke unjustified access within five business days for standard users, forty-eight hours for production API keys, and immediately for terminated employees regardless of review cycle timing. SLAs apply from attestation decision date, not review cycle start. Track mean time to remediate as a governance KPI reported to the AI governance committee quarterly.
- Terminated employee: revoke all AI access within four hours of HR notification.
- Orphaned API key (no owner attestation): revoke within forty-eight hours.
- Excessive privilege (admin without justification): downgrade within five business days.
- Contractor past end date: revoke within twenty-four hours of contract expiration.
- Shadow AI account: block within forty-eight hours or approve within ten business days.
Exception Handling
Document time-limited exceptions when revocation would break production systems: name compensating monitor, assign interim owner, set hard expiration within thirty days, and require security approval. Exceptions without expiration become permanent shadow access. Review all active exceptions monthly until closed.
Automated vs Manual Review Tools
Automate access inventory collection and reviewer routing through IAM governance platforms (SailPoint, Saviynt, Okta Identity Governance); reserve manual review for judgment calls on business justification and data sensitivity. Manual spreadsheet reviews fail above fifty accounts per platform. Automation does not replace manager attestation; it accelerates evidence collection.
Automation Capabilities
Integrate AI vendor admin APIs or SCIM provisioning with your identity governance tool to pull live account lists, detect drift between IdP groups and vendor roles, and auto-revoke on HR termination events. Not every AI vendor supports SCIM; for those, schedule monthly CSV exports via API or admin console automation. API key rotation should integrate with secrets managers that enforce TTL.
| Capability | Automated | Manual |
|---|---|---|
| Account inventory | API/SCIM sync | Admin console export |
| Reviewer routing | Workflow engine by data owner | Email with spreadsheet |
| Business justification | Pre-filled from ticketing | Manager attestation |
| Revocation | HR-triggered deprovisioning | Admin action for edge cases |
| Audit evidence | GRC platform export | Signed attestation PDFs |
Audit Evidence Package
Each completed review cycle produces an evidence package: account inventory snapshot, reviewer attestations with timestamps, remediation tickets with closure dates, and exception register. SOC 2 auditors sample one quarter annually; incomplete evidence packages fail logical access controls testing. Store packages immutably for seven years.
Integration With Joiner-Mover-Leaver Processes
AI platform access must participate in standard joiner-mover-leaver (JML) workflows: provision only approved tools during onboarding, re-evaluate access on role change, and revoke all AI credentials during offboarding before final paycheck. JML automation handles real-time changes; quarterly access review catches drift that JML missed, such as privilege escalation within the same role or API keys created outside the provisioning system.
Role Change Triggers
When an employee transfers departments, trigger an ad hoc access review for all AI tools within five business days even if the quarterly cycle is months away. Marketing-to-engineering transfers often leave marketing AI tool access active while new engineering tools get provisioned without review. HR system integration should emit role-change events to the IAM governance workflow.
Privilege Creep Detection
Compare current permissions against the role-based access baseline quarterly; flag accounts with permissions exceeding their role template for mandatory downgrade or documented exception. Admin roles on AI chatbot platforms grant access to conversation logs containing customer PII. Privilege creep from temporary project needs is the most common finding in AI access reviews.
Annual Review Calendar
Publish a twelve-month review calendar assigning Q1 through Q4 cycles per platform tier, with monthly API key reviews on the first business week and termination-triggered reviews outside the calendar. Predictable scheduling helps data owners allocate time. Avoid scheduling all platforms in the same week; stagger to maintain review quality.
API Key Lifecycle Management
Production AI API keys require named owners, documented purpose, creation date, last-used timestamp, rotation schedule, and environment label (production, staging, development). Development keys must not access production data. Enforce key rotation every ninety days for production through secrets manager automation. Keys unused for sixty days trigger automatic revocation unless the owner attests within five business days.
Shared Team Keys
Prohibit shared team API keys in production; each integration service account gets its own key with a named human owner responsible for attestation. Shared keys make revocation impossible without breaking unknown consumers. If legacy shared keys exist, inventory all consumers during the next review cycle and migrate to individual keys within sixty days.
Frequently Asked Questions
How do we handle contractor access to AI tools?
Provision contractors through time-bound accounts tied to contract end dates; include them in quarterly reviews with the sponsoring manager as reviewer; auto-revoke on contract expiration without waiting for the next cycle. Contractors should never hold admin roles on production AI platforms unless security approves a documented exception. Personal email accounts are prohibited for contractor access.
Are service accounts and API keys in scope for access review?
Yes. Every API key and service account requires a named human owner, documented purpose, last-used timestamp, and monthly attestation for production environments. Orphaned keys with no owner get revoked immediately. Rotate keys at least annually even when attestation confirms continued need. Store keys in a secrets manager, never in source code repositories.
What about employees using personal AI accounts for work?
Personal accounts fall under shadow AI policy, not standard access review; discovery and blocking replace attestation workflows until the employee migrates to an approved enterprise account. Access review covers enterprise-provisioned credentials only. Network monitoring and expense audits supplement review for personal account detection.
Is quarterly review realistic for a thirty-person company?
Start with semi-annual review for low-risk tools and quarterly for any platform processing customer data; a single IAM owner can complete small-team reviews in under four hours per cycle. Enterprise customers will ask about access review cadence regardless of company size. Lightweight spreadsheet attestation satisfies early-stage audits if evidence is complete.
Onboarding New AI Platforms Into Review Scope
When procurement approves a new AI platform, IAM operations adds the platform to the access review calendar within five business days with tier assignment, reviewer mapping, and evidence collection method documented. New platforms default to quarterly review at the assigned risk tier. Delayed onboarding to the review program is a common audit finding: the tool appears in the inventory register but never enters the access review cycle.
Deprovisioning Checklist
When an AI platform is decommissioned, revoke all credentials, export final access list for archive, remove the platform from the review calendar, and confirm no orphaned API keys remain in secrets managers or CI/CD pipelines. Decommissioning without access cleanup leaves dormant credentials that attackers or former employees may exploit. Include decommissioning in the quarterly governance committee report.
Metrics and Continuous Improvement
Track access review program metrics: completion rate per cycle, mean time to remediate findings, orphaned credential count, and repeat findings per platform. Report metrics to the AI governance committee quarterly. Declining completion rates signal reviewer fatigue or unrealistic scope; address by automating inventory collection or reducing platform count through consolidation.
Common Findings Patterns
The most frequent AI access review findings are: terminated users with active seats, contractors past end date, production API keys without owners, admin roles on chat platforms with conversation log access, and OAuth grants to deprecated AI applications. Build remediation playbooks for each finding type so reviewers know the expected action without consulting security for every entry.
Cadence Prevents Credential Drift
An AI access review cadence policy succeeds when scope covers users, groups, API keys, and integrations; data owners attest with segregation of duties; remediation SLAs close findings before the next cycle; and automation collects evidence auditors expect. Treat AI platform credentials with the same rigor as financial system access, because the data they process is often equally sensitive.
