Access requests, effective access and access history

Review an access request (UA04)

1. 1

   Open the request

   e.g. ACCESS-DEMO-014 — verified applicant, requested scope REQ-026-014 and MR-026-014, sponsor.

2. 2

   Check independence

   You must hold delegation and cannot approve your own elevation.

3. 3

   Record bounded approval

   Grants only the requested authorized records and actions.

4. 4

   Or return with reason

   The requester sees the reason.

Test effective access (UA05)

Pick an actor and an action (e.g. *Synthetic vendor employee* → *Read MR-026-014*). The simulation returns allow/deny with the intersecting gates — membership, role, scope, authority, module, policy — and a safe reason (e.g. *Agency assignment required*). It never reveals protected record contents, names or counts and is not live impersonation.

Access history and review (UA06)

/pdcc/admin/access-history lists grants, expiry and removals with auditable evidence. Audit permission is separate from user administration; output is sanitized and never includes credentials.

1. 1

   Review current assignments

   Filter by user, grant or date.

2. 2

   Remove a scoped grant

   Only the selected grant is removed; affected sessions and caches are invalidated and dependent automation runs pause. History is preserved.

3. 3

   Export authorized audit

   For audit readers with scope.