What it is
The Universal Review & Attestation Engine is a single shared system that powers every flow where a set of people each have to read and acknowledge, attest to a fact, make a keep/revoke decision, or complete a checklist - and the work is "done" once enough of them have responded.
It is the sibling of the Universal Approval Engine. The difference is the model:
- An approval is a gate - a pool of approvers decides approve or deny before something proceeds, and the request advances through ordered stages.
- A review is a per-person completion record - each assignee's submission is their own personal sign-off, not a vote that resolves the whole. The campaign finishes when its completion rule is met.
Before this engine, "everyone must acknowledge the new handbook" / "every control owner must attest quarterly" / "each reviewer signs off on this access list" were each built separately with their own storage, reminders, and tracking. The engine consolidates that: a feature simply requests a review and registers what to do when it completes; the engine handles assignment, per-person tracking, the completion rule, reminders, escalation, the unified inbox, notifications, and the audit trail.
The completion model
Every review campaign has a kind (what each assignee does) and a completion rule (when the campaign is done):
| Kind | What each assignee does |
|---|---|
acknowledge | Read and affirm an attestation statement (document acknowledgements, policy sign-off). Affirmation is required to count as complete. |
attest | Confirm a fact, optionally with a pass/fail verdict and linked evidence (control attestation, vendor review). |
decision | Make a keep / revoke / exception decision (access-review item sets). |
checklist | Complete a set of checklist items (QA checklists). |
| Completion rule | The campaign finishes when… |
|---|---|
all (default) | Every assignee has responded (a decline counts as a response - it does not block the others). |
quorum | A set number (M of N) of assignees have completed. |
any | The first completion finishes it. |
Each completed submission captures an immutable record: who, when, the verdict (if any), a snapshot of the attestation text as it stood at sign-off, the IP address, optional comments, and the channel (web / MCP / email token). Later edits to the campaign never change what someone already attested to.
What plugs into it
Owning features adopt the engine through a small adapter - they say what to do when each person completes and when the whole campaign completes; the engine does the rest. Live today:
- Document Acknowledgements (TATER Ops → Knowledge → Document Reviews) - post one or more documents for assigned staff to read and acknowledge. The acknowledgement's own signature store stays the source of truth; the engine mirror feeds the cross-org inbox and reporting.
- User Access Reviews (UAR) - keep/revoke decision campaigns over account access, with account-type end-state profiles, orphaned-account discovery, and an auditor decision-trail export. See the section below.
User Access Reviews (UAR)
A User Access Review campaign puts a set of accounts and their access in front of a reviewer, who records a per-item decision - keep, revoke, or exception. Beyond the basic keep/revoke flow, UAR campaigns include the following capabilities.
Revoking with account-type end-state profiles
When you choose Revoke on an item, the Revoke picker asks what kind of account it is, and dispositions it to the matching end-state profile instead of a single generic revoke:
| Account type | End state |
|---|---|
| Intern / Contractor | Delete the account. |
| Departing Employee | Disable the account and strip group memberships; retain the mailbox. |
| Departing Manager / Exec | Convert the mailbox to a shared mailbox. |
| Service / Shared Account | Assign an owner, or decommission. |
When the campaign is finalized, the offboarding steps for the chosen profile ride onto the resulting remediation task, so the person working the ticket gets the correct checklist for that account type. The chosen profile is also recorded on the decision for the audit trail.
"Keep & always re-review"
Some access is legitimately retained but should never be permanently approved - a shared or role mailbox, a departed exec's mailbox kept for continuity. The Keep & always re-review decision keeps the item now, but the item re-surfaces as PENDING in every subsequent review cycle, with the prior decision and its justification shown read-only so the reviewer re-confirms with the earlier rationale in view. There is no permanent snooze.
Finding orphaned accounts
The 🔍 Find orphaned accounts scan on the Access Review panel diffs every Entra member account against your People directory (the active-employee roster) and surfaces accounts with no matching active employee - former employees never fully offboarded, orphaned intern accounts, un-owned service and shared accounts - as review items. Each is flagged no-matching-employee plus disabled / dormant / never-signed-in as applicable, with last-sign-in and account context for the reviewer. The scan is a no-op when the People directory is empty, so it never false-flags your whole tenant.
Exporting the decision trail
The ⬇ Export decisions button on the Access Review detail page downloads a CSV of the per-item decision trail - account, access, decision, decision-maker, timestamp, justification, and the resulting Ops ticket - plus the campaign's mapped control-evidence, so an auditor can sample decisions with the supporting rationale attached. Also available at GET /api/access-reviews/{id}/decision-export?format=csv for a direct pull.
For reviewers - the My Reviews inbox
Anyone assigned a review works from My TATER → My Reviews (my.tatersecurity.com). It is a single cross-organization queue: if several organizations or help desks you work with each assign you something, they all appear in one list. Open an item, read its instructions and documents, affirm the attestation (or record a verdict / decline), add optional comments, and submit. Your completion is recorded immediately.
For admins - ad-hoc campaigns and the sweep
Beyond the feature-driven campaigns, an Admin can create an ad-hoc review campaign directly - a one-off "everyone please attest to X" - via the API or the MCP complete_review workflow. Every open campaign is covered by a reminder, escalation, and SLA-expiry sweep that runs every few hours:
- Reminders re-notify still-pending assignees on a configurable cadence (default every 72 hours), and stop automatically once someone completes.
- Escalation notifies a configured escalation list once a campaign has gone too long with no completion (default 168 hours).
- SLA expiry - a campaign with a due date can be set to auto-finalize as completed (partial) when the date passes, or simply left open.
- Campaigns in suspended or cancelled organizations are skipped.
MCP tool reference
| Tool | Purpose |
|---|---|
list_my_reviews | List reviews / attestations / sign-offs awaiting your completion, across every flow and every organization. Viewer+. |
list_reviews | List the organization's review campaigns with per-assignee completion progress, completion rule, and subject type. Optional status / subject-type filters. Auditor+. |
complete_review | Record your completion of a review awaiting you (affirm an acknowledgement, give a verdict for an attest/decision, or decline). Admins can complete on behalf of a pending assignee. Requires identity verification. Get the id from list_my_reviews. |
Related
- Document Reviews & Acknowledgements - the first feature on the engine, with the full admin/reviewer walkthrough
- Approvals - the sibling engine for approve/deny gates
- Notification Hub - where review assignment / reminder / completion notices surface
- My TATER for end users - the personal dashboard hosting the My Reviews inbox
- MCP setup - connecting Claude Desktop / API to TATER