Reports prove the review happened. INSIGHTS tells you whether it worked.
A certification campaign is an event. A certification programme is a series. INSIGHTS turns closed campaign occurrences into comparable terms, reconciles them object by object, and names what changed, what came back, and where a revocation had no effect.
The questions a second campaign should answer.
What changed?
Between two occurrences of the same series: objects present in both, identical decisions, and every change of family. Kept to revoked, revoked to kept, revoked to exception, co-owners now diverging. Three directions, not two.
What came back?
Objects revoked last time and presented again this time. Either the revocation was never applied, or the access was granted again. The module names the fact and both causes. It does not guess which.
Is the effort worth it?
Revocation effort per occurrence, decision delays as median and ninetieth percentile, concentration on a single reviewer or the top three. Whether the campaign teaches your reviewers anything, in numbers.
Which campaigns are comparable, and why the others are not.
The entry screen lists every series in the workspace, ordered by arming date, with the terms excluded and their reason: no frozen perimeter, no arming date, still open, simulation. A series is proposed by configuration equality and qualified by overlap.
- Configuration key. Workspace, resource key, policy key, targeting mode and a normalised perimeter signature. Recomputed on read, never stored.
- Chronological barrier. The second term must be frozen after the first is closed, or the finding is withheld. No reservation, no caveat.
- Simulation excluded. A rehearsal produces no decisions, so it forms no term.
Two closed occurrences, object by object.
Reconciliation identity is the object, its type, its workload and its solution, frozen at arming. Not a fingerprint of attributes: a fingerprint would hide the modified objects, which are the only interesting ones.
- Four decided families. Kept, revoked, exception (allowed or inherited), divergent (co-owners disagree). A change is any move between them.
- Paged detail. Every population opens into the objects behind the number, with the page in the URL, exportable without the reviewer's identity.
- Only decisions count. Cancellations written by administrators and closures by default are excluded before anything is counted.
The finding that points outside the platform.
REVIEWIT certifies decisions. It does not execute them. So an access revoked in the last campaign and presented again in this one is either a revocation that was never applied, or an access granted again. Both are your organisation's facts, and both deserve a name.
- The chain. Revoked last time, re-presented this time, then kept again. Three links, each with its number.
- Two causes, no verdict. The module does not decide which cause applies. It gives you the list to find out.
- An argument for the board. "We revoked 340 accesses and 120 are still active" is a diagnosis of your remediation, made by your certification tool.
What INSIGHTS refuses to do, on purpose.
No reviewer is ever measured.
Complacency is measured at the level of the device, never the person. The contract makes a reviewer identity impossible to compile into a metric.
No auditor access.
INSIGHTS carries self-criticism. It is yours. Auditors read the sealed evidence, not your analysis of it.
No alert, no signed piece.
A series finding never closes and has no gesture in the product, so it is not an alert. It is exported as data, never as a signed document.
No unratified number.
A metric whose threshold is not yet calibrated on real data shows a dash and its reason. A new notion is amber and marked "to arbitrate".
INSIGHTS is part of Unlimited.
OneShot certifies a campaign. Unlimited certifies an estate and learns from one occurrence to the next. The upgrade path is a product mechanism, not a pricing footnote.