> ## Documentation Index > Fetch the complete documentation index at: https://www.c1.ai/docs/llms.txt > Use this file to discover all available pages before exploring further. # Use case: User access review (UAR) automation > See how C1 automates access reviews from campaign scoping through completion — routing, context, remediation, and audit evidence — and where to go for setup details. A user access review (UAR) confirms that the access people already have is still appropriate — and revokes it when it isn't. Auditors don't just check that reviews happened; they check that every decision is evidenced, on time, for every system in scope — a missed campaign or an unresourced spreadsheet is a finding waiting to happen. Run manually, that's a spreadsheet and a lot of chasing. In C1, it's a [campaign](/docs/product/admin/campaigns): a scoped, policy-driven review that routes each decision to the right person, gives them the context to decide quickly, and carries the outcome through to remediation and an audit record. This page walks that flow end to end. This is one piece of the broader [identity governance](/docs/product/use-cases/identity-governance) picture — access reviews are how you verify that the access granted through onboarding, self-service requests, and provisioning is still correct. This page assumes you've already [added and configured connectors](/docs/baton/intro) for the systems you want to review. If you're setting up C1 for the first time, start with [Get started with C1](/docs/product/how-to/qs-set-up-c1). ## Scope the right reviews Not every review needs to cover every permission. [Building a campaign's scope](/docs/product/admin/campaigns#step-3-choose-what-to-review) lets you review by application, by specific entitlements, by resource hierarchy (for cloud infrastructure), or by risk level and compliance framework — so a high-risk admin role and a low-risk read-only group don't get reviewed on the same cadence or by the same process. You can narrow further by user criteria (department, manager, profile attributes) or by grant criteria (unused access, temporary grants, direct vs. inherited access). When the visual filters aren't precise enough, user, account, and grant selection all accept a raw [CEL expression](/docs/product/admin/expressions) instead — see [CEL expression examples](/docs/product/admin/expressions-examples) for real-world patterns. Reviews can also be scoped directly to risk: run a campaign [against the users and entitlements flagged by an active conflict monitor](/docs/product/admin/access-conflicts#review-access-conflicts-in-a-campaign) to remediate separation-of-duties violations instead of reviewing everyone. Rather than configuring scope field by field, describe the review you need in plain language and let the [Campaign assistant](/docs/product/admin/campaigns#create-a-campaign-with-the-campaign-assistant) set up the policy, owners, and scope for you to review and adjust. For a review pattern you'll run repeatedly, save it as a [campaign template](/docs/product/admin/campaigns#create-a-campaign-template) instead of rebuilding it each time. ## Route every decision Every review needs an owner. C1's [policies](/docs/product/admin/policies#assign-for-review) route each task to a manager, an app owner, an entitlement or resource owner, an account owner (self-review), a specific user, or a group — with a fallback reviewer if the primary reviewer can't be identified. If someone shouldn't receive tasks at all — an executive, someone on leave — [set a delegate](/docs/product/admin/delegate) to redirect their reviews automatically. ## Give reviewers context A reviewer's job is to decide, not to go hunting for the facts behind the decision. Each review task's [details drawer](/docs/product/how-to/review-tasks#step-3-review-the-access-and-provide-your-decision) shows an **Insights** tab with how many other users hold the same access, its risk level, and related context, plus any attached resource attributes (like an AWS IAM policy) rendered as readable JSON instead of raw text. ## Focus people on exceptions C1 flags individual reviews with a recommendation — **Take a closer look** or **Remove this access** — so reviewers can [act on exceptions instead of re-deciding routine access one row at a time](/docs/product/how-to/review-tasks#review-recommendations-and-insights). For faster batch work, the [review assistant](/docs/product/how-to/review-tasks#get-agent-help-reviewing-access) is an AI agent that acts on plain-language instructions ("approve all tasks with approve recommendations," "deny access to the Admin entitlement") and stages the changes for the reviewer to confirm before anything submits — people stay responsible for the decision, the agent just clears the routine work faster. ## Complete remediation A denial isn't the end of the review — the access still has to come off. [Revoking access denied during a campaign](/docs/product/admin/manage-campaigns#revoke-access-that-was-denied-during-the-campaign) follows the same deprovisioning method configured on the entitlement, and can be automated as a follow-up step on the campaign's review policy so revocation kicks off without a manual pass after the campaign ends. For apps that can't be deprovisioned automatically, [route the revocation to your ITSM as a ticket](/docs/product/how-to/automate-revocation-tickets), and track whether that ticket resolved — campaign reports include ticket status as an optional column. For remediation that isn't deprovisioning or a ticket — updating an external system of record, calling a custom endpoint — write it as a [Function](/docs/product/admin/functions) and run it as a follow-up step on the review policy. ## Preserve audit evidence Every campaign has a built-in [report](/docs/product/admin/manage-campaigns#generate-a-campaign-report) covering scope, reviewer, decision, and outcome, and you can [verify a downloaded report's file hash](/docs/product/admin/manage-campaigns#verify-report-hashes) to prove it hasn't been altered since it was generated. Every task also carries its own audit log and comment history, and the underlying identity and access events are available as [system logs](/docs/product/admin/system-log) in OCSF format for export to a SIEM or long-term storage. ## Related resources