Run quarterly access confirmations, record confirm / revoke decisions, attach evidence notes, and export a summary for ISO 27001 audits. Admins create review periods and add systems to the matrix.