What it is
A free access review desk in your browser. It reads simple role lists or CSV exports and turns them into one matrix, a route finder and a ranked list of risks.
Access review map
Who can touch what? Draw the map before the auditor asks.
Paste your roles and what each one may do, then who holds which role. Permission Map resolves every grant with deny over allow, draws the access matrix, traces the route from a person to any resource and flags the combinations that cause incidents.
Who it is for
Founders preparing a security questionnaire, admins cleaning up roles, engineering leads before an audit and anyone asked who can delete customer data.
What it solves
Access truth is scattered across an identity provider, spreadsheets and old tickets. Nobody sees that one person can both create and approve a payment until it happens.
Map your roles
Everything is parsed and resolved in this tab. Nothing you paste is uploaded or stored.
One role per line like support: tickets:*, customers:read. A leading ! means deny. CSV with role, resource, action, effect also works.
Optional. One person per line like deniz: finance_clerk, finance_lead. Without it, every role is checked on its own.
No map yet
Paste your roles, or load the demo company to see every kind of risk.
Your lists never leave this page. The report contains role names, resources and findings only.
What each risk means
Combined checks look at people when you add the people list, and at single roles when you do not.
Separation of duties High
The same person can create and approve, or request and release, on one resource. Most fraud and many outages start here.
Full admin High
A role with *:* can do anything, including things that do not exist yet. Keep it to as few people as possible.
Privilege escalation High
Whoever can assign roles or edit permissions can grant themselves anything else, so their real access is everything.
Audit trail tampering High
Deleting or editing logs lets someone hide what they did. Audit logs should be append only.
Wildcard on sensitive data Medium
resource:* on secrets, payments or personal data quietly includes every future action too.
Personal data export Medium
Bulk export or download of customer data is the most common path to a reportable data leak.
Allow and deny clash Medium
A role both allows and denies the same action. Deny wins, so the allow is dead weight and confuses reviewers.
Deny with no effect Low
A deny line that blocks nothing because no allow ever reached it. Harmless, but it hides real intent.
Duplicate grant Low
The same grant appears twice. Clean lists are easier to review.
Unknown role Low
Someone is assigned a role that has no grants. Usually a typo, sometimes a role deleted in one system only.
Unused role Low
A role with grants that nobody holds. Old roles get reassigned by mistake later.
Formats it reads
Mix them freely. Names are not case sensitive and spaces become underscores.
Role lines
support: tickets:*, customers:read, !customers:deleteRole, colon, then grants separated by commas. resource.action works too.
CSV export
role,resource,action,effect
ops,servers,restart,allowComma, semicolon or tab. The effect column is optional and defaults to allow.
People
deniz: finance_clerk, finance_leadPerson, colon, roles. Or two columns, person and role, one row per assignment.
How to use it
Paste the roles
Export them from your admin panel or write them by hand. Use * for every resource or every action.
Add the people
Optional but powerful. Risks that come from holding two roles at once only show up with people.
Read the findings
High risks first. Each one names the person, the roles and the exact lines that cause it.
Check the matrix and routes
Switch between roles and people, then ask who can do one specific action and follow each route.
Keep the evidence
Download the matrix CSV and copy the report with its SHA 256 into your access review ticket.
Good to know
- It models allow, deny and wildcards. Conditions like time of day, IP ranges or resource ownership are not evaluated.
- Role inheritance is not followed automatically. List inherited grants on the child role.
- It shows what your lists say, not what your system enforces. Compare it with a real export.
- Risk rules use common names like approve, export and audit. Unusual names may need a quick rename.
Questions
Can I paste an export from my identity provider?
Yes, if you can get it into rows of role, resource and action. Most admin panels export CSV that fits after removing extra columns.
Why does deny win?
That is how almost every access system works. A single deny blocks the action no matter how many roles allow it.
Does it change anything in my systems?
No. It only reads what you paste. Enforcement stays in your real access control.
What should I do with a high risk?
Split the role, remove one of the two roles from the person, or add an explicit deny and note who approved the exception.