Admin Access Register

What it is: Who holds admin rights on each system, with a backup admin and review dates.

Overview

Works out the smallest useful Admin Access Register setup for the business in front of it, then builds it only when asked. The default output is a short recommendation, not a spreadsheet. Artifacts - CSV, SQL DDL, JSON Schema, Notion mapping - are produced on request, from one field list so they cannot drift apart.

Layer: Layer 7: Protect. Fits: Growth stage. Table code: n/a.

When to Use This Skill

• admin access register
• system access review
• privileged account list
• quarterly access review

Also use it when the user says "who holds admin rights on each system, with a backup admin and review dates", or describes the same process happening in a spreadsheet, a document or someone inboxes.

Do not use it for: payroll calculation, tax filing, or legal advice. This skill produces empty templates by default. A requested review may transiently use supplied data; minimize it rather than promising the host never processes it.

How It Works

Follow the shared execution contract. The module-specific rules below define only domain fields, decisions, calculations, and safety constraints.

The upstream shared execution contract is not bundled; use this file directly. For an account-by-account register, derive a separate confirmed account identifier and grain instead of repeating the system aggregate counts on every account. Store a vault reference only, never passwords, tokens or recovery codes.

Step 1 - Identify intent

Read the request and pick the intent before asking anything.

• "set up" or "build" or "create" -> the user wants artifacts; go to Step 2.
• "our process is ..." or "it is in a sheet" -> the user wants to move an existing process; capture it, then Step 2.
• "is this right" or "review" or "audit" -> the user wants a check, not a build; answer from what they share.
• "how do I ..." -> advice question; answer directly and offer the build only if it helps.

Ask only if this is the highest-value missing fact; otherwise proceed without an opener:

Q: How many admin accounts exist?

Step 2 - Ask only what is missing

Skip anything the user already answered, in any earlier message. Ask the rest one at a time, and stop as soon as the remaining answers would not change the output.

• Scope - Which systems? / How many admins? / Vendor or employee admins?
• Ownership - Who approves access? / Named owner per account? / Any shared logins?
• Review - How often reviewed? / What happens on leaving? / Evidence kept?
• Current process - Is it recorded now? / IT ticket or nothing? / Is it current?
• Outcome - What do you need? / A register, a review cycle or both?

Never invent an answer. If the user does not know, record it as unknown and carry on.

Step 3 - Hold the internal context

Hold the answers in this shape. It stays internal - it is not shown to the user unless they ask, and it never carries a value the user did not give.

module: admin-access-register
intent: null            # setup | advice | review | fix | build | convert | export
scale: null             # Starter | Growth | Scale, only if the answer changes it
areas:
  "Scope": null
  "Ownership": null
  "Review": null
  "Current process": null
  "Outcome": null
requested_outputs: []   # csv | sql | json | notion | xlsx - requested formats only
confirmed_facts: []     # only what the user actually said
open_questions: []      # the unanswered ones, in the order worth asking

Step 4 - Recommend the smallest workflow

If an artifact was requested, build it after resolving essential missing facts. Otherwise give a short recommendation and offer the relevant artifact.

Recommended approach: Keep one row per system with named main and backup admins, aggregate admin count and review dates. Shared logins are the first thing to fix.

Why this one: Privileged accounts are the ones that matter after someone leaves. Naming an owner per account is what makes removal possible.

Workflow: System listed → Admin account → Owner and approver → Periodic review → Removal

Step 5 - Build only on request

Once the user asks for it, derive the fields from the confirmed context and emit the requested artifacts. For machine-readable text, keep prose outside the data; for files, provide a usable link. Report material validation failures or limitations separately.

A selected Notion output is rendered by notion-manual-import, so route the Notion step there. When the user selects Notion, hand that step to @notion-manual-import: it holds the CSV, the property mapping, the import steps and the verification checklist, and it renders the Field Reference below instead of defining a table of its own. Do not restate the mapping here and do not improvise the import steps. Manual CSV and mapping outputs need no connection. For requested workspace changes, follow the share