Article 7: Completing a Review — Reviewer Guide
This article is written for reviewers — the people who are assigned accounts to certify during an access review cycle. If you're a Ploy admin setting up or overseeing reviews, see the articles on creating campaigns and the approval workflow.
How you access your review
When you're assigned to a review, Ploy notifies you by email or Slack (depending on your organisation's notification settings). The notification includes a link directly to your review in the Ploy employee portal.
The portal is a separate, dedicated app for employees and reviewers — it's different from the main Ploy admin dashboard. Your organisation's portal is accessed at a unique subdomain address that will be included in your notification link.
If you've previously logged into the portal, you may already have an active session. If not, clicking the link will take you through a quick magic-link login — no password required.
Finding your assigned review
Once you're logged in to the portal, navigate to Access Reviews. You'll see a list of campaigns you currently have active reviews in. Each campaign card shows:
The campaign name and description
The review due date
How many accounts are assigned to you and how many you've completed
Click into a campaign to see your full list of accounts to review.
What you'll see for each account
For every account assigned to you, Ploy displays:
Employee details — name, email, department, job title (snapshotted at the time the review was created)
Application — which app or resource is being reviewed
Access level / role — what role the employee holds in that app
Entitlements — the specific permissions or groups they're assigned within the app (where available)
Last accessed — when the employee last actively used this account (where usage data is available)
Access granted — when the employee was first given this access
Luna's recommendation — Ploy's AI suggestion for this account (see Article 8: Luna AI Suggestions)
This context is there to help you make an informed decision. If you're unsure about any of it, you can also view the employee's full access history in Ploy.
Making a decision
For each account, you select one of the outcome options configured for your campaign. The exact options depend on how your admin set up the campaign, but typically they include:
Appropriate / Required / Compliant
Select this if the employee should keep this access as-is. This closes the review for this account with no further action.
Not Appropriate / Not Required / Non-Compliant
Select this if the employee should not have this access. When you select this and submit, Ploy will trigger a remediation action (removing access automatically or creating a task for manual removal, depending on the app's configuration). You may be asked to add a note explaining your decision. This note becomes part of the audit record.
Adjust Entitlements
Select this if the employee should keep access to the app, but their specific permissions need to change (e.g. they should move from admin to read-only). This opens an entitlement editing panel where you can flag the specific permissions to be changed.
Out of Scope
Select this if this account isn't relevant to this particular review (e.g. it's a shared service account, a contractor who operates under different rules, or an account you don't have the context to review). You'll be asked to provide a reason.
Adding notes
You can add a free-text note to any decision. Notes are visible to the admin who approves the review and become part of the audit record. They're particularly useful when:
Your decision isn't straightforward and you want to explain your reasoning
You're flagging something for the admin's attention
The outcome is "out of scope" (a reason is typically required)
Uploading evidence
If you have supporting documentation for your decisions — access logs, usage reports, screenshots, approval emails — you can attach these as evidence to the review. Evidence files are uploaded at the review level (not per-account), so one set of evidence covers all the accounts in your assigned set.
To upload evidence:
Open the review in the portal
Click Evidence or the evidence upload option
Drag and drop files or browse to select them (PDF, Excel, images, and other common formats are supported; maximum 50MB per file)
Evidence appears in the review record and is available to the approving admin and to auditors.
Working through accounts in bulk
If you have a large number of accounts to review and many of them have the same outcome (e.g. a long list of accounts you've verified are all appropriate), you can select multiple accounts and apply a decision in bulk using the floating action bar at the bottom of the screen.
Select the checkboxes next to the accounts you want to act on, choose your outcome from the action bar, and confirm.
Luna's recommendations can also help you work through routine approvals faster (see Article 8).
Submitting your review
Once you've made a decision on all accounts in your assigned set, a Submit button becomes available. Submitting sends your completed decisions to the admin for approval.
After submission:
The account set status changes to Submitted
The admin is notified that your review is ready for their review
Your decisions are locked — you can no longer change them unless the admin sends the review back to you
Important: You must submit your review before the due date shown on the campaign. If you miss the deadline, the admin will be notified and may send you a reminder.
If your review is sent back for revision
If the admin reviewing your submission has questions or wants you to reconsider a decision, they can send your account set back to you with a revision message. You'll receive a notification, and the review will reappear in your portal with the admin's comments.
Review the revision message, update your decisions as needed, and resubmit.
What happens after you submit
Once the admin approves your submitted account set:
Any accounts you marked as "not appropriate" will have their access removed (automatically or via a manual task, depending on the app)
Any entitlement adjustments you flagged will be actioned
A compliance certificate is generated for the review
Your decisions, notes, and evidence become part of the permanent audit record
You'll receive a notification when the review is fully complete and approved.