dsh-access-review-proof
Offline, deterministic evidence for one narrow question: does the supplied access-review campaign cover every declared entitlement, satisfy its risk-based review stages, and close each keep/revoke decision into a fresh post-review inventory?
The same headless core is exposed as a DSH bundle, standalone MCP stdio server, JavaScript API and CLI. Reports are redacted, content-addressed and verified after writing.
Complementary boundary
Microsoft Entra access reviews govern and recertify access to groups, applications, access packages and roles. This plugin only verifies supplied structured evidence; it is not an identity-governance platform.
dsh-principal-binding-proof verifies which authority and principal an evidence chain binds.dsh-policy-waiver-proof verifies a declared policy exception.dsh-break-glass-settlement-proof verifies closure of one emergency-access session.- This plugin checks a complete declared entitlement inventory, staged reviewer decisions, applied keep/revoke closure and a post-review snapshot.
It never approves, keeps or revokes access; authenticates receipts; queries live identity infrastructure; or proves the supplied inventory contains every real entitlement. A supplied closure or snapshot is evidence to authenticate elsewhere.
Checks
- review start, completion, due date, closure, snapshot and evaluation chronology;
- exact coverage of the declared entitlement set;
- risk-based stage counts and contiguous ordered decisions;
- independent reviewers for configured high-risk classes, excluding self-review;
- a common review binding across decisions, closures and snapshot;
- one closure per entitlement, after review completion;
- final
keep/revoke decisions matching active/revoked closures;
- non-zero application receipts for revocations;
- exact active/revoked partition in the post-review snapshot;
- observer diversity and evidence freshness;
- secret/raw rejection, workspace confinement, symlink defense and content-addressed read-back.
Use
npm test
npm run check
node bin/dsh-access-review-proof.mjs inspect examples/closed.json
node bin/dsh-access-review-proof.mjs verify examples/closed.json
dsh plugin --profile <profile> add /absolute/path/to/dsh-access-review-proof
dsh plugin --profile <profile> add github:dongsheng123132/dsh-access-review-proof#<commit>
DSH tools are dsh_access_review_inspect and dsh_access_review_verify. MCP tools are access_review_inspect and access_review_verify.
See examples/closed.json. Only public IDs, timestamps, counts and SHA-256 bindings belong in a manifest. Never put credentials, account names, tokens, raw identity exports or business text in it.
References: Microsoft Entra access reviews overview, plan an access reviews deployment, complete an access review.
