41 Periodic access recertification

A quarterly cycle in which every grant class — admin roles, group memberships, shared-drive membership, OAuth grants, mailbox delegates — is enumerated into one attestation sheet, sent to its named owner, and revoked unless the owner re-affirms it. The default on no reply is revoke. The signed sheet, not the enumeration script, is the audit evidence.

Documentation: Security checklist for medium and large businesses (100+ users) ↗

Caveats

Recertification that defaults to KEEP on no-reply is theatre¹
A scripted enumeration that silently 404s produces a clean, empty, wrong report²
Group membership is the grant path people forget³
It depends on the account inventory (№5) being real⁴

Setup steps

Enumerate every grant class into one attestation sheet — admin roles, group memberships, shared-drive membership, OAuth grants, delegates.
```
gam print admins
gam print group-members
gam print shareddrives
gam all users print tokens
gam all users print delegates
```
Control which apps access Google Workspace data ↗ Let users delegate access to a Gmail account ↗
open ↗
https://admin.google.com/ac/list/roles · captured 2026-07-15
Account › Admin roles
Signed in as a super administrator, read the admin-role assignments in the console as a cross-check against the script's output — a scripted enumeration that silently 404s produces a clean, empty, wrong report. The console's Roles page lists direct assignments only, not roles inherited through group membership, so treat it as a floor on the grant count, not the full surface.

Compare direct-assignment row count to gam print admins; group-inherited role assignments will not appear in the console list

View role assignments & privileges ↗
open ↗
https://admin.google.com/ac/groups · captured 2026-07-15

Send each grant to its named owner for attestation with a default of REVOKE, not a default of KEEP.

Quarterly cycle; no reply within 10 working days = revoke
open ↗
https://admin.google.com/ac/owl/list?tab=configuredApps · captured 2026-07-15

Execute the revocations and keep the signed sheet — that sheet, not the script, is the audit evidence.
```
gam delete admin <roleAssignmentId> / gam update group <group> remove member <user> / gam user <user> delete token clientid <clientid>
```

Ongoing maintenance

automatable: script Quarterly: run the enumeration and send attestation requests.
requires a human Quarterly: chase non-responses and execute default-revoke.

How to verify

Check the latest signed attestation sheet is no older than one cycle and its revocations were executed — spot-check one revoked grant is actually gone.
```
gam print admins  # revoked role must be absent
```

Further screens

Admin console screen — Directory > Users (accounts, suspension state, delegates) — https://admin.google.com/ac/users captured 2026-07-15

v0.1.3Assure policy #29 · #28, #12 ↗