Privileged Login Review

IT / AUTOMATE.md

Every Friday at 4pm, pull the week's admin sign-ins, flag any from a country or address not seen before, and post the short list for review.

This is the whole automation. Run it as it is, or change any word, including the tools it names.

  • Off-pattern admin logins listed
  • New locations highlighted
  • Findings routed to the security queue

How it runs

  1. 1. Starts

    Every Friday at 4:00pm

  2. 2. Delivers to

    Slack

  3. 3. You decide

    Approve each time, or let the steps you trust run. Your choice.

Why IT and security teams set this up

Administrator rights are handed out to clear a one-day problem and never handed back, so the list of people who can change production grows every quarter. Nobody can say which of those grants are still required, and the evidence an auditor asks for is a screenshot of a settings page.

See the whole job: Privileged access review

Use it as is. Or make it yours.

Edit it the way you would edit a note to a colleague. It follows the new version from the next run.

  • Change when it runs

    Move it to another day or time, or start it when something arrives, like a new email.

  • Add your own rules

    Limits, exceptions and what good looks like go in the same file, in plain words.

  • Decide what waits for you

    Mark the steps that need your OK, and let the rest run.

You stay in charge.
At every step.

It triages and sweeps. People approve every change.

  • No change without approval

    Blocking, revoking and purging wait for an analyst's OK.

  • Every run on the record

    What it read, what it did and what it is waiting on, kept for review and audit.

  • Scoped per automation

    Each automation gets only the access you grant it, and a local model can keep processing on your machine.

Privileged Login Review

Approve before it posts in Slack?

ReviewApprove

Before you download.

Where does it run?
On your Mac or Windows computer, in the background. It keeps working after you close its window, and only reaches the folders and apps you connect for each automation.
How does it connect to our CRM and other tools?
Through each app's own connection where it offers one, signed in once by you, or by using the app in a browser the way you would. Each automation gets only the connections you give it, and the tools a page names are examples you can swap for your own.
Does it run when my computer is asleep?
It keeps your computer awake while a job runs and just before a scheduled one. While the computer is closed or off, nothing runs; when it wakes, it checks the inbox, calendar and other sources it watches for anything that arrived meanwhile.
How does my team use it?
Each person who runs automations installs the app. Keep a project in a shared folder, such as Google Drive or a network drive, and teammates can open it and follow every run, while one person owns it and runs it.
Do I need anyone technical to set it up?
No. Download the app, add an automation in plain words, and connect only what that job needs. Nothing runs until you switch it on.

Already have tools for this? Here is the difference.

Scripts and scheduled jobs

Precise, repeatable system tasks.

They break on the unexpected, and only their author can read or change them.

Security automation platforms

High-volume response playbooks in large teams.

They need a project to set up and an engineer to maintain each playbook.

AI chat assistants

Explaining an alert when you paste it in.

Nothing runs on schedule, and there is no scoped access or record of what was done.

AUTOMATE.md

Your routine, written in plain words. It runs on its own, follows your rules, handles the exceptions a flowchart can't, and asks you when it matters. The file stays yours, whichever AI model runs it.

Other setups for the same job.

Access Review Evidence Pack

When a review cycle closes, pull the decisions into one evidence document and attach it to the compliance record, so the next audit question is a download.

When an access review cycle closes

Elevation Expiry Check

Every weekday at 8am, list admin grants older than 30 days from the vault, then open one review ticket per owner with the reason each grant was issued.

Every weekday at 8:00am

Just-In-Time Admin Request

When an engineer asks for production access, record the reason, issue a four-hour elevation through the vault, and link the change ticket so the session can be reviewed later.

When an engineer requests production access

Related workflows

Access reviews

Works the periodic entitlement list so access nobody still needs is released, and every decision is written down.

Write your own

Joiner, mover and leaver access

Grants, adjusts and removes application access from one approved people record, so nothing survives a leaver.

4 automations

Audit trails

Joins the scattered administrative change records into one timeline, so an auditor's question is a search rather than a fortnight of exports.

Write your own

Start with one job.
Make it your own.

macOS — coming soon
  1. 1

    Get the app

    It runs on your computer, next to your files.

  2. 2

    Add the automation

    Paste the instructions into the app, or save them as a file next to your work.

  3. 3

    Try it, then turn it on

    Run it once and check the result. It only runs on its own once you switch it on.

macOS — coming soon