Automate access reviews and account checks

Collect privileged access grants for owners to review, find accounts that outlive their purpose, and investigate risky sign-ins. AI agents can also draft tighter cloud policies as pull requests.

Tools for identity management, authentication, and access control

MCP servers for the tools used in these examples.

AWS

Automation examples and starter prompts

Paste a prompt into Claude Code, Microsoft Copilot, or Codex connected to Tracecat MCP. Adapt it to your tools and test before deployment. Human tool approvals and advanced case features require Enterprise.

Review privileged access on a schedule

PR.AA-05

Build me a privileged access review in Tracecat. Each quarter, pull admin role members from Okta, Entra ID, and AWS, group them by system owner, and run the review as Slack messages where each owner confirms or rejects every grant. Track responses in a table, open revocation tasks for rejections, and chase owners who have not answered. First help me understand how this maps to PR.AA-05 and why access reviews fail when they arrive as spreadsheets. Ask me which systems hold our most dangerous admin roles. Talk me through verifying revocations actually happened instead of trusting the confirmation click.

Catch dormant and orphaned accounts

PR.AA-01

Build me an account hygiene automation in Tracecat. Every week, find accounts in Okta and Entra ID with no sign-in for thirty days, contractor accounts past their end date, and service accounts with no recorded owner. Open a Jira ticket per finding with the suspend-by date, and auto-suspend dormant accounts after the grace period passes with no objection. First help me understand how this maps to PR.AA-01 and why credential lifecycle gaps are a top initial access path. Ask me what grace periods fit our culture. Talk me through which account types are safe to auto-suspend and which need a human look first.

Respond to risky sign-ins

PR.AA-03

Build me a sign-in response automation in Tracecat. When a risky sign-in alert fires, pull the user's recent sessions and MFA factors from Okta, check whether the location and device fit their history, and message the user in Slack to confirm it was them. On no answer or a denial, clear their sessions and require re-enrollment, with the action gated behind an approval. First help me understand how this maps to PR.AA-03 and where authentication signals are strong enough to act on automatically. Ask me what our current MFA coverage looks like. Talk me through modeling this as an agent on each alert versus a fixed workflow.

Verify least privilege in cloud roles

PR.AA-05

Build me a least-privilege audit in Tracecat. Pull IAM roles from AWS with the permissions they grant versus the actions actually used in the last ninety days, rank roles by unused privilege, and have an AI agent draft the tightened policies as a Terraform pull request in GitHub for the platform team to review. First help me understand how this maps to PR.AA-05 and why unused permissions are the cheapest risk to remove. Ask me which accounts or roles are off limits for tightening. Talk me through batching the changes so reviews stay small enough to merge.

NIST CSF 2.0 mapping: PR.AA

Official NIST category: Identity Management, Authentication, and Access Control. Access to physical and logical assets is limited to authorized users, services, and hardware and managed commensurate with the assessed risk of unauthorized access

The controls and implementation examples below are NIST source material. The automation prompts above are Tracecat-authored starting points, not evidence of compliance or full control coverage.

PR.AA-01
AC-1
AC-2
AC-14
IA-1
IA-2
IA-3
IA-4
IA-5
IA-6
IA-7
IA-8
IA-9
IA-10
IA-11
Identities and credentials for authorized users, services, and hardware are managed by the organization
- Initiate requests for new access or additional access for employees, contractors, and others, and track, review, and fulfill the requests, with permission from system or data owners when needed
- Issue, manage, and revoke cryptographic certificates and identity tokens, cryptographic keys (i.e., key management), and other credentials
- Select a unique identifier for each device from immutable hardware characteristics or an identifier securely provisioned to the device
- Physically label authorized hardware with an identifier for inventory and servicing purposes
PR.AA-02
IA-12
Identities are proofed and bound to credentials based on the context of interactions
- Verify a person's claimed identity at enrollment time using government-issued identity credentials (e.g., passport, visa, driver's license)
- Issue a different credential for each person (i.e., no credential sharing)
PR.AA-03
AC-7
AC-12
IA-2
IA-3
IA-5
IA-7
IA-8
IA-9
IA-10
IA-11
Users, services, and hardware are authenticated
- Require multifactor authentication
- Enforce policies for the minimum strength of passwords, PINs, and similar authenticators
- Periodically reauthenticate users, services, and hardware based on risk (e.g., in zero trust architectures)
- Ensure that authorized personnel can access accounts essential for protecting safety under emergency conditions
PR.AA-04
IA-13
Identity assertions are protected, conveyed, and verified
- Protect identity assertions that are used to convey authentication and user information through single sign-on systems
- Protect identity assertions that are used to convey authentication and user information between federated systems
- Implement standards-based approaches for identity assertions in all contexts, and follow all guidance for the generation (e.g., data models, metadata), protection (e.g., digital signing, encryption), and verification (e.g., signature validation) of identity assertions
PR.AA-05
AC-1
AC-2
AC-3
AC-5
AC-6
AC-10
AC-16
AC-17
AC-18
AC-19
AC-24
IA-13
Access permissions, entitlements, and authorizations are defined in a policy, managed, enforced, and reviewed, and incorporate the principles of least privilege and separation of duties
- Review logical and physical access privileges periodically and whenever someone changes roles or leaves the organization, and promptly rescind privileges that are no longer needed
- Take attributes of the requester and the requested resource into account for authorization decisions (e.g., geolocation, day/time, requester endpoint's cyber health)
- Restrict access and privileges to the minimum necessary (e.g., zero trust architecture)
- Periodically review the privileges associated with critical business functions to confirm proper separation of duties
PR.AA-06
PE-2
PE-3
PE-4
PE-5
PE-6
PE-8
PE-18
PE-19
PE-20
Physical access to assets is managed, monitored, and enforced commensurate with risk
- Use security guards, security cameras, locked entrances, alarm systems, and other physical controls to monitor facilities and restrict access
- Employ additional physical security controls for areas that contain high-risk assets
- Escort guests, vendors, and other third parties within areas that contain business-critical assets

Control text and SP 800-53 Rev 5 references from the official NIST CSF 2.0 and OLIR releases.

Build your own security automation

Adapt a starter prompt with your coding assistant, choose where AI agents or fixed workflows fit, and test with your tools.

All examples Book a demo