Quarterly Auth0 access review board for SOC 2 evidence

Build me an internal access review board that our security lead opens once a quarter to certify who still has privileged access in our Auth0 tenant. A review session starts with the reviewer entering their name and their own Auth0 user id or email address. That name stamps every decision they record, and their identity powers the self revocation guard described below. The app has two tabs: Roles (the default) and Organizations.

The Roles tab lists every tenant role using List Roles. For each role show the permissions attached to it via List Role Permissions, as a count with the full list revealed on expand. Sort privileged roles to the top: treat any role whose name contains admin or owner, case insensitive, as privileged and give it a clear Privileged badge. Everything else sorts alphabetically underneath. Each row should also show how many people hold the role.

Expanding a role shows every holder from List Role Users. Enrich each holder with their last login timestamp and email verification status using Search Users, batching lookups by user id or email rather than firing one call per holder. For each person show name, email, last login as both an absolute date and a days ago figure, and a verified or unverified badge. Highlight anyone whose last login is 90 or more days ago, or who has never logged in, in a warning style labelled likely revoke candidate. That highlight is the whole point of the screen, so make it impossible to miss.

The Organizations tab does the same thing for organizations. List them with List Organizations, which uses checkpoint pagination: pass take, then pass from set to the id of the last item you received, rather than page numbers. Selecting an organization lists its members via List Organization Members. Expanding a member shows the roles they hold inside that organization via List Organization Member Roles, with the same Search Users enrichment, the same privileged sorting, and the same stale access highlighting.

Every holder row has two buttons: keep and revoke. Keep simply records the decision and makes no API call. Revoke asks for confirmation naming the person and the role, then calls Remove Roles from User on the Roles tab, or Remove Organization Member Roles on the Organizations tab, and records the decision. Both outcomes append to a running decision list for the whole session, shown in a side panel with a live count. The decision list survives switching between tabs, expanding and collapsing roles, and moving between organizations.

Never let a reviewer revoke their own admin role. Match the session reviewer's user id or email against each holder, and when they are the same person on a privileged role, disable the revoke button with a tooltip explaining why instead of hiding it. Enforce the same rule in the handler so it cannot be bypassed from the client.

An Export button appends the whole decision log to a Google Sheets tab using Append Values, one row per decision with reviewer name, review date, role name, user email, and decision (keep or revoke). Let the reviewer choose or paste the spreadsheet and the tab name, and write a header row first if the tab is empty. After exporting, confirm how many rows were appended and keep the log on screen rather than clearing it, so a reviewer can export again without losing their work.

A few technical details to get right. Auth0 user ids embed the identity provider, like auth0|66f1... or google-oauth2|1057..., and must be URL encoded when used in a path segment. Page based pagination is capped at the first 1,000 results, so for wide tenants refine the query rather than paging forever, and prefer loading people role by role over enumerating all users. Roles returned by List User Roles are direct assignments only, so if you surface that anywhere, say so in the UI rather than implying it includes organization scoped grants. Expanding several roles fans out into many calls, so respect Auth0 rate limits with backoff and show a loading state per role instead of blocking the whole screen.

The reason this app exists is SOC 2 CC6.3, which requires periodic review of user access rights and expects documentation of who approved each grant and when, tied back to the identity provider. Most teams run this quarterly out of a hand built spreadsheet. This app should replace that ritual end to end, so favour a dense, scannable review surface over a pretty dashboard.