Access Review Procedure
Implements: Access Control Policy Section 5 (Access Review) Owner: Security Lead Version: 1.1 Last Updated: 19 June 2026 Next Review: 21 November 2026 Change (1.1): downpipes added as second in-scope platform; the legacy backup worker retired in favour of self-hosted downpipes.
Scope. This procedure operates at the organisation level and covers access across both Maelstrom AI platforms — Provii (privacy-preserving age verification) and downpipes (no-custody backup & disaster recovery for the Cloudflare data layer). It reviews the access Maelstrom itself holds: GitHub, Cloudflare, the Provii administrative surface and the downpipes vendor-side control-plane, update channel and release pipeline. The downpipes engine and console run in the customer’s own Cloudflare account, under the customer’s own identity provider and keys (customer-operated; a complementary user-entity control), and Maelstrom keeps no standing inbound path into customer tenants — so operator access within a customer tenant is the customer’s responsibility and out of scope for this review.
Schedule
Access reviews are conducted quarterly (March, June, September, December) and immediately when:
- A team member leaves the organisation
- A role change removes the need for previous access
- A security incident suggests unauthorised access
Scope
| System | What to Review | How to Check |
|---|---|---|
| GitHub (our GitHub organisation) | Members, teams, outside collaborators, deploy keys (covers both Provii and downpipes repositories) | GitHub Settings > People, Teams |
| Cloudflare | Account members, API tokens, Workers Secrets access (includes the downpipes vendor-side control-plane and the Licence Signer in Secrets Store) | Cloudflare Dashboard > Members, API Tokens |
| Provii Admin Portal | Admin users, role assignments (viewer/admin/super_admin) | provii-management user list endpoint |
| downpipes control-plane | Operator access to the vendor-operated control-plane (licence token minting, advisory beacon). Holds no customer keys, data or Cloudflare tokens; fail-open. | control-plane operator/member list |
| downpipes update channel & release pipeline | Who can publish to the signature-pinned update channel (updates.downpipes.io) and the release pipeline. Note: the Update Signer is held offline by the operator and is never deployed to any Worker — it is not a system-access grant. | R2 bucket writers; release pipeline members |
| Domain registrar | Account access | Registrar dashboard |
| Mailbox access, aliases | Email provider admin |
The downpipes engine and console run in the customer’s own Cloudflare account under the customer’s own identity provider and keys; access inside a customer tenant is a customer responsibility (CUEC) and is not reviewed here.
Review Steps
1. Export Current Access
For each system, list all users and their access level.
2. Compare Against Authorised List
Check each user against:
- Current employees/contractors (from contractor tracking template)
- Their current role and whether it requires this access
- The principle of least privilege. Does anyone have more access than needed?
3. Remove Unnecessary Access
For any user who:
- No longer works with Maelstrom AI → remove immediately
- Has changed roles and no longer needs this access → remove or downgrade
- Has access beyond what their role requires → downgrade
4. Document
Record the review in a simple table:
| User | System | Current Access | Action | Justification |
|---|---|---|---|---|
| Example | GitHub | Admin | Keep | ISMS Owner. requires admin |
| Example | Cloudflare | Member | Remove | Contract ended |
5. Sign Off
Security Lead signs off on the completed review. The review document is saved for audit evidence.
Immediate Revocation (Offboarding)
When someone leaves:
- GitHub: Remove from our GitHub organisation (revokes access to both Provii and downpipes repositories)
- Cloudflare: Remove account membership, revoke API tokens they created
- Provii Admin Portal: Disable their admin account
- downpipes vendor-side: Revoke their access to the control-plane and to the update channel / release pipeline
- Rotate shared secrets: If the person had access to production secrets, rotate them. If they had access to the offline-held downpipes Update Signer, rotate the signer and re-pin the engine’s verification key
- Confirm by attempting to log in as the removed user (should fail)
- Document in the offboarding checklist