Privileged Access Changes

This is the help text the console shows in the help panel on this page.

Privileged Access Delta

This report detects role changes across all assets — specifically flagging escalations where an account moved from a standard role to a privileged one (role names such as admin, owner, root, write, prod or global). Privilege escalations are high-risk events that should always be intentional and authorized. Terminated employees are not listed.

Reporting window

By default the report covers role changes from the last 90 days, shown as a chip above the table. Turn on Show history to see every role change ever detected. PDF always exports the last 90 days.

Event Types

The Type column shows one of:

• Escalation: A non-privileged role became privileged. Highest risk — requires immediate review.
• Grant: Privileged or other access was added with no previous role.
• Change: Any other role change.

Key Metrics

• Total Role Changes: All role changes detected in the reporting window.
• Escalations: Changes from a non-privileged to a privileged role.
• De-escalations: Privileged role reduced to a non-privileged one. Generally positive — confirms least-privilege enforcement.
• Lateral Moves: Moved between two different privileged roles.

Filter: Escalations Only

Use the All / Escalations Only switch above the table to focus exclusively on the highest-risk events. The table shows the previous and new role, the detection date and a risk score, newest first.

Compliance Note

ISO 27001 A.8.2 requires that privileged access assignments be reviewed and authorized. Each unreviewed escalation in this list is a potential audit finding.