Everything I can get into that belongs to the client, and everything of mine that holds their data. One row per credential or grant. A row is only closed when access is revoked and I have confirmed I am locked out.
Reviewed at: kickoff · delivery · handover. Any row still open at handover blocks the project being called finished.
Last reviewed: [DATE] by [NAME]
Access I hold
| # | System | What it covers | Type | Scope / permission | Granted by | Granted | Revoked | Locked-out verified |
|---|---|---|---|---|---|---|---|---|
| 1 | e.g. SharePoint | /Ops/Exports only | App registration | Files.SelectedOperations.Selected, read | [name] | YYYY-MM-DD | ||
| 2 | e.g. Drive folder | /Ops/Exports only | Service account | Shared to SA, viewer | [name] | YYYY-MM-DD | ||
| 3 | e.g. Azure sub | rg-dashboards | User account | Contributor on one RG | [name] | YYYY-MM-DD | ||
| 4 | e.g. Git repo | project repo | Personal account | Write | [name] | YYYY-MM-DD |
Getting the grain right matters here. Sites.Selected scopes to a site collection, not to a folder — if the row says one folder, the permission you want is Files.SelectedOperations.Selected, granted on that file or folder. Writing Sites.Selected next to a folder path in this register would record access narrower than what was actually granted, which is the specific failure this document exists to prevent.
| 5 |
Type: app registration · user account · API key · service account · shared folder · VPN · SSH key · physical
Access others hold to my side
Anyone I have given access to something of mine that touches this project — subcontractor, client staff on my repo, a support account.
| # | Person / account | What they can reach | Why | Granted | Revoked |
|---|---|---|---|---|---|
| 1 |
Secrets in play
Names only. Never values.
| # | Secret name | Where it lives | Used by | Last rotated | Rotated at handover |
|---|---|---|---|---|---|
| 1 | Key Vault: [name] | YYYY-MM-DD |
Review log
| Date | Trigger | Rows changed | Notes |
|---|---|---|---|
| kickoff / delivery / handover / person left / scope change |