# Privileged Access Changes
URL: https://docs.autociso.io/console/ciso-reports/privileged-access-delta/
Description: This report detects role changes across all assets — specifically flagging escalations where an account moved from a standard role to a privileged one (role names such as admin, owner, root, write, prod or global).

*This is the help text the console shows in the help panel on this page.*

## Privileged Access Delta

This report detects [role changes across all assets](https://docs.autociso.io/console/access/inventory/) — specifically flagging **escalations** where an account moved from a standard role to a privileged one (role names such as admin, owner, root, write, prod or global). Privilege escalations are high-risk events that should always be intentional and authorized. Terminated employees are not listed.

### Reporting window
By default the report covers role changes from the **last 90 days**, shown as a chip above the table. Turn on **Show history** to see every role change ever detected. **PDF** always exports the last 90 days.

### Event Types
The **Type** column shows one of:
- **Escalation**: A non-privileged role became privileged. Highest risk — requires immediate review.
- **Grant**: Privileged or other access was added with no previous role.
- **Change**: Any other role change.

### Key Metrics
- **Total Role Changes**: All role changes detected in the reporting window.
- **Escalations**: Changes from a non-privileged to a privileged role.
- **De-escalations**: Privileged role reduced to a non-privileged one. Generally positive — confirms least-privilege enforcement.
- **Lateral Moves**: Moved between two different privileged roles.

### Filter: Escalations Only
Use the **All** / **Escalations Only** switch above the table to focus exclusively on the highest-risk events. The table shows the previous and new role, the detection date and a risk score, newest first.

### Compliance Note
ISO 27001 A.8.2 requires that privileged access assignments be [reviewed and authorized](https://docs.autociso.io/console/iso/access-reviews/). Each unreviewed escalation in this list is a potential audit finding.