ACCESS REVIEW AUTOMATION: THE BUILD

Welcome back to The Illumenati. In Part 1, we covered why User Access Reviews are mandated by every compliance framework and why the manual spreadsheet approach doesn't scale.

Now it's time to build. This issue is pure hands-on engineering: we're configuring a complete automated access review workflow in Tines using Google Workspace and Salesforce as our target systems.

By the end of this guide, you'll have a working automation that:

No spreadsheets. No manual data collection. Let's build.

> INTEL DROP: What Happened This Week

Major Breaches & Security Incidents

GRC Automation & Tooling Updates

> ANALYSIS: Tines Architecture Overview

Before we start building, let's understand how Tines works. If you've used other automation platforms like Zapier or n8n, some concepts will feel familiar—but Tines is purpose-built for security and compliance workflows.

Core Tines Concepts

Action Types We'll Use

Tines provides several action types. For our access review workflow, we'll use:

Our Workflow Architecture

Here's what we're building—a complete automated access review pipeline:

> TECH RITUALS: Building the Workflow

PHASE 1: Authentication Setup

Before we can pull user data, we need to authenticate with Google Workspace and Salesforce. Both platforms use OAuth 2.0, but the setup differs.

1.1 Google Workspace Service Account Setup

Google Workspace requires a service account with domain-wide delegation. Here's the process:

Step 1: Create a Google Cloud Project

Step 2: Create Service Account Credentials

Step 3: Enable Domain-Wide Delegation

Step 4: Add Credential to Tines

In your Tines tenant, navigate to Credentials in the left sidebar:

1.2 Salesforce Connected App Setup

Salesforce uses OAuth 2.0 with a Connected App. Here's the configuration:

Step 1: Create a Connected App in Salesforce

Step 2: Get Consumer Key and Secret

Step 3: Add Credential to Tines

In Tines, create a new OAuth 2.0 credential:

PHASE 2: Data Collection

Now we'll create the Tines Story and build actions to pull user data from both systems.

2.1 Create the Story

2.2 Action 1: Scheduled Trigger

First, we need a trigger to start the workflow. Drag a Schedule action onto the canvas:

This triggers at 9 AM on the first day of each quarter. For testing, you can manually emit an event by clicking "Run" on the action.

2.3 Action 2: Fetch Google Workspace Users

Add an HTTP Request action to pull users from Google Workspace:

Response Structure: Google returns a users array with objects containing primaryEmail, name, isAdmin, suspended, lastLoginTime, and orgUnitPath.

2.4 Action 3: Fetch Salesforce Users

Add another HTTP Request action for Salesforce:

SOQL Query Breakdown:

2.5 Action 4: Fetch Salesforce Permission Set Assignments

Profiles alone don't tell the full story—Permission Sets grant additional privileges. Add another HTTP Request:

PHASE 3: Data Enrichment & Anomaly Detection

Raw user lists aren't actionable. We need to enrich the data and flag anomalies that require manager attention.

3.1 Action 5: Normalize & Merge User Data

Add an Event Transform action to combine Google Workspace and Salesforce users into a unified structure:

3.2 Action 6: Flag Dormant Accounts

Users who haven't logged in for 90+ days should be flagged for review:

3.3 Action 7: Cross-Reference with HR System (Optional)

If you have an HR system like BambooHR, Workday, or even a Google Sheet with employee data, you can detect orphaned accounts—users who have system access but are no longer employed:

3.4 Action 8: Detect Orphaned Accounts

3.5 Action 9: Flag High-Privilege Accounts

Admin accounts and elevated permissions require extra scrutiny:

PHASE 4: Manager Notification

Now we send personalized review requests to managers. Each manager receives a list of their direct reports with flagged anomalies.

4.1 Action 10: Group Users by Manager

First, we need to group users by their manager. This requires a manager mapping—either from your HR system, Google Workspace org chart, or a maintained resource in Tines:

Pro Tip: If you don't have manager data in your systems, create a Tines Resource (a JSON object) that maps departments to manager emails. You can update this manually or sync it from a spreadsheet.

4.2 Action 11: Create Review Form Page (Tines Pages)

Tines has a built-in feature called Pages that lets you create simple web forms. This is how managers will submit their approve/deny decisions:

The Page URL will look like: https://your-tenant.tines.com/pages/abc123-access-review

4.3 Action 12: Send Email to Managers (Explode Loop)

We need to send one email per manager. Use an Explode action to loop through the manager list, then a Send Email action:

PHASE 5: Response Handling & Audit Logging

5.1 Action 13: Receive Form Submissions (Webhook)

When managers submit the review form, the Page posts to a Webhook action in your Story:

5.2 Action 14: Log to Audit Trail (Google Sheets)

Every decision needs to be logged with a timestamp for compliance evidence. Google Sheets makes a simple, auditor-friendly audit trail:

Audit Sheet Structure:

5.3 Action 15: Send Confirmation to Manager

Putting It All Together: The Complete Workflow

Here's the final workflow architecture with all actions connected:

Testing Your Workflow

Before going live, test each phase independently:

> THE BOTTOM LINE

You now have a complete, working automated access review workflow. Let's recap what we built:

What used to take 4-6 weeks now runs automatically. Managers get clean, contextualized requests instead of 500-row spreadsheets. You get timestamped audit evidence generated in real-time. No more chasing responses. No more manual data collection.

What's Next: Part 3

In Part 3, we'll take this foundation and level up:

The manual access review era is over. The automation is here—and it compounds with every review cycle.

Welcome to The Illumenati. The enlightened don't export spreadsheets and chase managers. They engineer their way out.

Stay enlightened. Part 3 is live — read it here.

The Illumenati // Boutique GRC for the AI-First Era // illumen.io