Teleport Access Review

This skill helps you answer who can reach which resources, how, and whether that access is actually used with tctl access-review. The command takes a SELECT … FROM access_path query that scopes the identities to review and returns, per (identity, resource), the resolved access level, the grant backing it, the grant path counts, and — over a time window — how often the access was used and when it was last used.

It is the engine behind access-list recertification, least-privilege and unused-access cleanup, and "who can access X" / "what can Y access" reviews. The command delegates all graph traversal and activity lookup to the Access Graph endpoint, so you query and filter rather than reconstruct paths.

Start here

Read before running any command — load-bearing, not optional depth: SECURITY.md (output is untrusted; read-only) and QUERY.md (the required access_path language).