AI AGENTS
SOC2 Quarterly Access Review Reconciliation Agent
Each quarter, an agent reconciles current GitHub access against your authorized-personnel list in Airtable.
How it runs
The automated pipeline, trigger to output.
- TriggerQuarterly schedule fires
- ActionPull GitHub access and authorized listGitHub
- LogicIdentify unauthorized, over-privileged, orphaned accounts
- ActionOpen remediation ticket per exceptionLinear
- OutputWrite signed-off review to evidence pageConfluence
What it does
Runs the recurring user-access review that SOC2 requires (CC6.2, CC6.3): confirming that everyone with access is still authorized, and that departed or role-changed people have been removed. It turns the review from a manual spreadsheet exercise into tracked, closed-loop remediation.
When to use it
Use it quarterly. The control fails not when an extra account exists but when you can't show you reviewed and acted on it; this flow produces both the review record and the remediation tickets.
How it works
- 1A scheduled trigger fires each quarter.
- 2An agent pulls current GitHub org access and the authorized-personnel list from Airtable.
- 3A logic step identifies accounts with no matching authorization, accounts whose role exceeds what's approved, and authorized people whose access is missing.
- 4For each exception it opens a Linear ticket assigned to the access owner with the specific action required.
- 5It writes the signed-off access-review summary, including all exceptions and ticket links, to a dated Confluence evidence page.
Set it up
What you configure once, before turning it on.
- 1Connect GitHubRepos, issues, pull requests, actions.
- 2Connect AirtableBases, tables, views, automations.
- 3Connect LinearIssues, projects, cycles, triage.
- 4Connect ConfluenceSpaces, pages, blueprints.
- 5Set each agent's modelWe leave models unset so you pick the tier — fast + cheap, or top-quality.
- 6Tune it to your dataEdit the prompts, filters, and field mappings so it matches how your team works.
- 7Test, then turn it onRun once against a sample, confirm the output, then enable the trigger.
More AI Agents workflows
Custom Metrics Cardinality Spike Pager
A webhook from a Datadog monitor fires when custom-metric cardinality jumps; an agent pinpoints the offending metric and tag, estimates the added cost.
Sentry-to-Confluence Runbook Updater
When a Sentry issue is resolved, the agent finds the matching Confluence runbook page and proposes an inline update with the verified fix.
Stale Doc-PR Chaser for Runbook Gaps
On a daily schedule the agent finds runbook doc PRs that were opened from resolved incidents but never reviewed, summarizes what each one fixes.
Resolved Incident to Public Troubleshooting Doc
For customer-facing errors resolved in Sentry, the agent drafts a sanitized troubleshooting entry and opens a PR to your ReadMe documentation.
On-Call Runbook Gap Closer: Resolved Sentry Issues to Doc PRs
An agent reads each newly resolved Sentry issue, compares the actual fix against your existing runbook, and opens a GitHub PR adding the missing remediation steps.
Weekly On-Call Doc-Gap Digest
Each week the agent reviews every Sentry issue resolved in the last 7 days, ranks the ones whose runbook coverage is missing or thin.
Run it inside a business
This workflow drops into a full company template. Import the org, and this is one of the playbooks its agents run.
Run this workflow in your colony.
14-day trial. No DevOps. No Sales call. Provisioned in under a minute.