Quarterly Google Groups access review, without the spreadsheet

I want an app for running our quarterly user access reviews on Google Groups, so our IT team can stop emailing a spreadsheet around every quarter. The failure we keep hitting is that the review and the actual removal are two separate exercises: everyone responds on time, and former employees still sit in groups for weeks because remediation is a manual follow-up. In this app, certifying and revoking are the same click.

The home screen is a campaign board. An admin creates a campaign with a name, a quarter and a due date, then picks which Google Groups are in scope, either by browsing everything with List Groups or by narrowing with Search Groups. Each in-scope group gets a reviewer assigned by email address. The board shows one card per group with its reviewer, how many members have been decided out of the total, and a completion bar, plus overall campaign progress and days remaining at the top.

Opening a group shows every member as a row. Load direct members with List Memberships and inherited members with Search Transitive Memberships, then merge them into one list where each row shows the person's email, their role (member, manager or owner), and whether their access is direct or comes through a nested group. For inherited rows, use Get Membership Graph to show the path, for example "via engineering-all". Each row has a Keep button and a Remove button. Keep records the certification. Remove calls Delete Membership and actually revokes the access.

Two nuances matter on removal. First, Delete Membership returns a long running operation rather than finishing immediately, so a removed row should display as Revoking until the operation reports done and only then flip to Removed. If it fails, show the error on the row with a retry rather than claiming the person is gone. Second, someone who is only in the group transitively has no membership in that group, so removing them means acting on the nested group that actually holds them. Show the reviewer which group holds the real membership and either revoke it there or record the row as escalated to that group, so nothing is silently marked done.

When someone holds owner or manager on a group and should not, the reviewer picks Downgrade to member, which calls Modify Membership Roles instead of removing the person entirely. That decision is logged like any other.

Each group has a Prepare this review button that starts a background agent for that group before the reviewer touches it. The agent walks the membership using List Memberships, Search Transitive Memberships and Get Membership Graph, and writes findings back onto the rows: members whose email domain is outside our own, members who only hold access through a nested group and probably do not know they have it, and a group level warning when the group has no active owner. It should also write a short summary at the top of the group, something like "34 members, 4 external, 9 inherited only, no owner assigned", so the reviewer sees the shape of the problem before scrolling. Findings are notes only. The agent never keeps, removes or downgrades anyone; it just means the reviewer is working through findings rather than a raw list.

Closing a campaign is one click and writes the full evidence trail into Google Sheets with Append Values: one row per decision carrying the campaign, group, member email, role, whether access was direct or inherited, the reviewer, the decision (kept, removed, downgraded), any agent flags on that row, and the timestamp. Append to a tab so history accumulates instead of overwriting. That sheet is the artifact auditors ask for. The same screen has a Nudge reviewers action that uses the Slack Send a Message action to message each reviewer who still has undecided rows, naming which groups and how many rows are outstanding along with the due date. Nobody who is finished gets messaged.

Reviewers only see the groups assigned to them; admins see the whole campaign. Decisions are immutable once submitted, so a submitted row locks and a correction is recorded as a new dated entry rather than an edit over the original. Past campaigns stay browsable in an archive, and there is a search box where anyone can type a person's email address and see every group they were reviewed in, who certified them, what was decided and when, which answers "who approved this person's access last quarter" without digging through email.

Campaigns, group scope, reviewer assignments, agent findings and decisions all persist in the app so a review survives a refresh and can be picked up over several days. Google Groups stays the source of truth for who is currently in a group, so re-opening a group re-reads live membership and the reviewer never certifies a stale list.