The role list after deletion, and the role's last-used date from before it.
Workflows · Access reviews
Remove admin roles nobody uses, then read the role list back.
Close CC6.3: remove AWS administrator roles unused for 180 days under written policy, send each account list to its system owner for sign-off, and keep the receipt.
Example workflow. Execution requires a configured tool with provider permissions for this action; see the connection’s operation reference or bring your company tool to the demo.
Agent request
Delete the AWS administrator role legacy-deploy, unused for 180 days
Deleting a role a service still assumes breaks that service; leaving it in place keeps CC6.3 failing.
- Identity
- access-review-agent · IT operations
- Target
- aws/legacy-deploy
- Cost
- Recorded agent cost
- Evidence
- Last-used date, trust relationships, and active-service check
SOC 2 CC6.3
Low-risk: runs within written policy.
CC6.3: Access changes and least privilege
The role as it stood with its last-used date, the policy section applied, the review list per system, the owner's sign-off, and the re-run of the CC6.3 test.
Policy decision
Administrator roles unused for 180 days are removed within written policy. A role used in the last 180 days requires the AWS account owner.
AWS account owner
The action waits until this owner approves or denies it.
Tool call resumes
AWS deletes the role, Deixic reads the role list back, and the receipt attaches to the CC6.3 test. The system owner signs the access review.
Tool call stays blocked
The role stays in place and the review list goes to the system owner as a decision.
Execution order
The agent request stops before the connected tool runs.
- 01Access-review agent requests the role removal
- 02Deixic checks the last-used date, trust relationships, and policy
- 03The role is removed within policy, or the AWS account owner decides
- 04Connected AWS account returns the deletion result
- 05Deixic reads the role list back and attaches the receipt to CC6.3
Activity history keeps the request, decision, cost, and result.
Keep the procedure for the next request.
Keep the policy and decision history, save the steps and evidence as a skill, and test changes on real sessions; an approval stays specific to its request.