Teleport Access List Review

$TCTL acl summary --review-only --format=json

This returns only access lists that are past due or within the 2-week notification window. Parse the JSON array.

See JSON schema reference for field descriptions, types, and enum values.

If the output is empty, tell the user there are no access lists requiring review at this time and stop.

Step 2: Assess Risk for Each List

Use the following criteria to classify each list as low-risk (auto-reviewable) or needs human attention:

Signals that support "low-risk / auto-reviewable"

• List name/title/description or role names suggest low-risk access using keywords like viewer, read, readonly, observer, monitor, auditor, reporter, staging, test.
• List is empty or has stable membership with last review being clean.
• List does not have expired or ineligible members.

Signals that push toward "needs human attention"

• Sensitive list name/title/description or role grants containing keywords like admin, editor, write, owner, prod, production, root, superuser, privileged.
• Members have notes on them indicating they were added to the list temporarily.
• List has expires or ineligible members.
• High member churn (>5 members removed) in past reviews.

Step 3: Present Findings Table

Show this table to the user (use markdown):

• Review Due Date: spec.audit.next_audit_date formatted as a date
• Auto-Review ✅: low-risk, safe to auto-certify
• Auto-Review ❌: needs human attention
• Risk Assessment: be specific — name the roles, note the history, explain the reasoning

Step 4: Ask for Confirmation

After the table, ask:

"Would you like me to auto-review the ✅ low-risk lists now? I'll submit a review via tctl acl reviews create for each one."

Wait for the user to confirm (e.g., "yes", "go ahead", "proceed"). Do NOT submit reviews without explicit human confirmation.

If there are no low-risk lists, skip this step and go straight to Step 7.

Step 5: Submit Auto-Reviews

If the user confirms, run for each low-risk list:

$TCTL acl reviews create <list-name> --notes "Auto-reviewed: low risk access list, no changes required."

Report success or failure for each one.

If the user asks to submit reviews for other lists as well, ask the user to provide notes for the review and use them in the command:

$TCTL acl reviews create <list-name> --notes "<notes>"

Step 6: Show Manual Review URLs

For every list marked "needs human attention" (❌), build a Teleport web UI URL using this format: