See llms.txt for all machine-readable content.

Back to Templates

Run quarterly user access reviews with Google Sheets, Gmail, and Google Docs

Created by

Created by: Ali Abdullah || ali-abdullahx1
Ali Abdullah

Last update

Last update 9 hours ago

Categories

Quick overview

Run a quarterly access review campaign: send each manager per-entitlement attestation links, log every decision in an audit log, chase overdue attestations, then close out the campaign with a deprovision list for revoked access.

How it works

  1. Runs on a quarterly schedule (or manual start) to launch an access review campaign.
  2. Reads existing review tasks from Google Sheets to decide whether to resume an already-open campaign or create a new one.
  3. For a new campaign, loads entitlements from Google Sheets, writes one open review task per unique entitlement, and emails each manager a Gmail attestation with per-entitlement Approve/Revoke webhook links.
  4. Runs daily to reload review tasks and audit history from Google Sheets, then sends Gmail reminders to managers and escalations to the compliance address based on task age, logging each chase event.
  5. Receives manager decision clicks via an n8n webhook, rejects invalid or bot-prefetched requests, and logs invalid attempts to the Google Sheets audit log.
  6. For valid decisions, verifies the entitlement is still open, matches the manager, and is within the 90-day window, then updates the Google Sheets task row and appends a decision event to the audit log.
  7. When all tasks in a campaign are decided, writes revoked items to a Google Sheets deprovisioning list, creates a Google Docs evidence document, emails a closeout summary via Gmail, and logs the campaign-closed event.

Setup

  1. Create a Google Sheets workbook with tabs for Entitlements, ReviewTasks, AuditLog, and DeprovisionActions, and update the sheet ID and tab names in the Workflow Configuration.
  2. Add Google Sheets, Gmail, and Google Docs credentials in n8n, and set a Google Drive folder ID where the evidence document should be saved.
  3. Set the compliance email address, reminder/escalation day thresholds, and the public webhook base URL in Workflow Configuration.
  4. Copy your n8n webhook base URL to match your instance hostname so the decision links resolve correctly (path: /webhook/access-review-decision).
  5. Populate the Entitlements tab with required fields (at least user_email, system, role, manager_email) to avoid skipped rows on launch.