Compliance track · 3 min

Read the log: who still had access?

A leaver's last day, as a log. Find the line that matters.

The idea

1A log is a story in rows
Each row has who acted, what they did, on what, and the result. Read the sequence, not one line.
2Find the change
Look for the event that should have ended access, such as the HR deactivation.
3Then look after it
Anything successful by that person after the change is the evidence of a gap.
4Trace the cause
The reason is usually an earlier line: a failed step nobody retried.

Try it

Which line shows the leaver still had access?

A simulated log with illustrative action names. Select the line you think is the problem.

This exercise needs JavaScript. Here is the answer key.

02 Mar 17:58	asha@example.com	user.sign_in	mail	success	103.21.x.x
02 Mar 18:02	hr-sync	user.deactivate	asha@example.com	success	-
02 Mar 18:02	system	app.deprovision	mail	success	-
02 Mar 18:02	system	app.deprovision	billing	success	-
02 Mar 18:03	system	app.deprovision	crm	failed	-
02 Mar 18:30	it-admin	audit.export	last 24 hours	success	49.36.x.x
03 Mar 09:14	asha@example.com	crm.export	contacts	success	103.21.x.x
03 Mar 09:20	asha@example.com	user.sign_in	mail	denied	103.21.x.x

Line 7 is a successful export from the CRM the morning after deactivation. Line 5 is the cause: the CRM step failed and nobody retried. Mail was refused, so sign-in worked; the CRM had a separate path.

Check yourself

1 of 3 Which evidence shows a gap?

2 of 3 Why read the lines before the gap?

3 of 3 What should you do with the finding?

Answer key

Which evidence shows a gap? A success by the leaver after deactivation. It proves access outlived the change.
Why read the lines before the gap? To find the cause. A failed step is a typical cause.
What should you do with the finding? Fix the connection and record it. Close the gap and keep the evidence.