OpenParable
Skip to content
← Back to skills

Access Review

DevOps & Security
access-review

Access Review is an Agent Skill for devops & security published in the getprobo/probo repository on GitHub: a SKILL.md instruction file an AI agent can load to do this task.

Run a semi-automated Probo access review campaign. Use when the user wants to review access entries, decide approve/revoke/escalate, or resume an in-progress campaign with MCP and .probo/access-reviews/ notes.

View on GitHub ↗
QUICK START

How to use this skill

Bring this guide into your coding agent with a prompt tailored to the tool you use.

  1. Open your project in Codex.
  2. Copy and paste the prompt below.
  3. Review files and risks before approving any action.
Prompt to paste
Inspect the Agent Skill at https://github.com/getprobo/probo/blob/HEAD/packages/skills/skills/access-review/SKILL.md and all supporting files. Report provenance, permissions, scripts, dependencies, and security risks. Propose an exact installation into .agents/skills/access-review, but wait for my approval before writing files or running scripts.

Copying this prompt does not install or run the skill. Review third-party files before use.

Access review

Run a semi-automated access review for campaign $ARGUMENTS (or ask the user for the campaign name). Review entries only — do not create, start, cancel, or close campaigns.

Before executing, read these files relative to this skill directory:

  • references/mcp-tools.md — MCP tool names, inputs, pagination
  • references/decision-rubric.md — semi-auto decision rules
  • references/notes-format.md — working memory file schema

Preconditions

  1. Probo MCP must be connected. If tools fail with auth errors, stop and tell the user to complete OAuth sign-in for the Probo MCP server in their agent (Claude Code: /mcp or claude mcp login probo; Codex: codex mcp login probo; OpenCode/Cursor: configure MCP in settings then authenticate).
  2. Resolve the campaign from $ARGUMENTS (name match or GID). If ambiguous, list listAccessReviewCampaigns results and ask the user to pick one.
  3. Campaign status must be IN_PROGRESS or PENDING_ACTIONS. Stop with a clear message for DRAFT, COMPLETED, or CANCELLED.

Working notes file

Create or resume .probo/access-reviews/<campaign-slug>.md per references/notes-format.md. Create .probo/access-reviews/ if missing.

Workflow

1. Orient

  • Call getAccessReviewStatistics for the campaign.
  • Summarize totals and pending count for the user.
  • If no pending entries, report completion and stop.

2. Fetch batch

  • Call listAccessEntries with campaign_id, filter.decision: PENDING, size: 50.
  • Use last_cursor from the notes file when resuming.

3. Classify each entry

Apply references/decision-rubric.md:

ClassAction
AutoQueue for recordAccessReviewEntryDecisions
AmbiguousPresent to user; do not write yet
SkipLog in notes only (no API write)

Hold auto decisions in memory until step 4 succeeds — do not append them to the notes file yet.

4. Write auto decisions

  • Batch via recordAccessReviewEntryDecisions when possible.
  • Non-APPROVED decisions must include decision_note.
  • On MCP error, stop and do not advance last_cursor or update entry notes.
  • After a successful API response, append each recorded auto decision to the notes file ## Entry notes table.

5. Present ambiguous entries

Show email, roles, flags, proposed decision, rationale. Record only after explicit user confirmation.

6. Checkpoint

Update notes: last_cursor, session log, updated_at. Ask to continue if next_cursor is set.

Hard rules

  • Never call closeAccessReviewCampaign or campaign setup mutations unless the user explicitly requests setup work outside this skill.
  • Never invent entry IDs or decisions — use MCP responses only.
  • Never record non-APPROVED without decision_note.