Article 6: How Review Cycles Work

What is a cycle?

A cycle is a single run of an access review campaign. Where the campaign is the standing instruction ("review all admin access every quarter"), the cycle is the live instance of that instruction — with a specific start date, due date, named reviewers, and a snapshot of all the access being reviewed.

Every cycle is numbered sequentially within its campaign (Cycle 1, Cycle 2, etc.), so you can track your review history over time.

How cycles are generated

Automatic generation (recurring campaigns): Ploy checks for active campaigns whose next review date has arrived, and automatically generates a new cycle. You don't need to do anything — the cycle appears in your dashboard, reviewers receive their notifications, and the clock starts on the due date.

Manual generation: You can also trigger a new cycle manually from the campaign detail page at any time. This is useful for running an ad-hoc review outside the normal schedule, or for starting the first cycle of a new campaign immediately.

What Ploy creates when a cycle is generated

When a cycle is generated, Ploy evaluates your campaign filters against the current state of your SaaS estate and builds the full review structure in one step:

1. The cycle record — with name, description, start date, due date, and remediation window (inherited from the campaign, but can be adjusted per-cycle)

2. One review per resource — for every app or resource that matches your campaign filters, Ploy creates a separate review. If your campaign covers 12 apps, you'll have 12 reviews in the cycle.

3. Accounts within each review — for each resource, Ploy creates an account record for every employee whose access matches the campaign filters. This is the list of individual access decisions that need to be made.

4. Entitlement snapshots — for each account, Ploy captures the current entitlements (the specific roles and permissions the employee holds in that app) at cycle generation time. These snapshots are immutable — they record what access looked like when the review started, regardless of what happens later.

5. Member snapshots — Ploy also snapshots each employee's department, job title, MFA status, and location at the time the cycle is created. This gives reviewers and auditors accurate context for who the person was at the time of the review.

6. Reviewer assignments — Ploy calculates which reviewer is responsible for each account based on the campaign's assignment configuration, and groups accounts into account sets accordingly.

7. Luna AI suggestions — Ploy enqueues an AI analysis job for each account set. Luna's recommendations are typically available within a few minutes of cycle generation.

8. Notifications — if notifications are enabled for the campaign, Ploy sends the first wave of notifications to assigned reviewers.

Cycle statuses

A cycle moves through the following statuses:

A cycle moves to Completed automatically once every review within it has been approved by an admin.

What reviewers see when a cycle opens

When a cycle is generated and reviewers are notified, they receive access to the employee portal (via magic link or their existing portal session). In the portal they see:

• A list of the campaigns they have an active review in

• For each review: the due date, the number of accounts assigned to them, and how many they've completed

• For each account: the employee's name, department, job title, the app and their role in it, entitlement details, last accessed date, and Luna's recommendation (if available)

Reviewers work through their assigned accounts, make a decision on each one, and submit their account set when they're done.

Following a cycle's progress

Admins can track a cycle's progress from the cycle detail page in the admin dashboard:

• Progress chart — shows completion percentage across all reviews in the cycle

• Reviews table — lists every review in the cycle with its status, assigned reviewers, and outstanding account count

• Tasks list — shows any remediation tasks that have been created for accounts marked as inappropriate

• Activity stream — a chronological log of every action taken during the cycle (decisions made, revisions sent, approvals given, notifications sent)

From this page, admins can also send reminders to reviewers who haven't started or completed their review, and can force-close reviews that are stalled.

What happens when a cycle ends

A cycle completes when all its reviews have been approved. At that point:

• Ploy generates compliance certificates for each approved review

• The cycle status updates to Completed

• The cycle record (including all decisions, evidence, attestation, and certificates) is preserved permanently as part of your audit trail

• If the campaign is recurring, Ploy schedules the next cycle based on the campaign frequency