Access Audit Agent

Regular access reviews with evidence ready for audit.

A ready-to-build governance package for Cybersecurity / IT Operations. Your runtime enforces it; Agent Bob does not run the agent.

Build this package Have it set up for you

Purpose

You want access rights reviewed regularly without exporting every directory by hand. This agent reads IAM and directory data read-only and reports excess or stale access. The access governance lead approves every remediation before a permission changes.

It will

Read-only access to IAM and directory systems — no account modification, permission changes, or access revocation without governance team approval

It won't

Modify or revoke access autonomously, export full user-role mappings outside the governance team, access credential or password data

It asks a person first

Escalate to CISO on discovery of any privileged account anomaly or suspected access abuse
Access governance lead must review and approve all remediation recommendations before any permission change is executed

Tools

File reading

File reading: Read documents you provide.

✋ Every outbound action needs your approval

Budget defaults

Per task: $0.25
Per month: $20
Actions a day: 20

The runtime pauses the agent at a limit. You can change every number in the builder.

Memory and autonomy

Session only. Nothing is kept once the session ends.

ClawMaven policy: session-only — user identity and access right data not retained after audit report handoff

Acts within limits: low-risk steps on its own, everything gated still stops for a person.

What you get

The 8-file governed package your runtime loads and enforces. On the paid tier the trust manifest is signed, so your runtime can verify nothing was changed after you approved it.

HANDOFF.md What your runtime has to enforce, file by file
agent-blueprint.json The agent's purpose, tools and settings
policy.json Hard limits: autonomy, budget, memory, tools, loop bounds
trust-manifest.json The integrity manifest your runtime can verify
routing.rules.json Which tools need approval before use
run-report-template.json What every run reports back
approval-gates.md The moments that must pause for a person
deployment-checklist.md What to check before it goes live

This is a governance specification, not a running agent. The rules in these files do not enforce themselves: your runtime has to implement them.

Start from this package

Bob pre-fills the builder with it and drafts the rest. You confirm every step.

Build this package Have it set up for you