An access review campaign is a bounded process that forces reviewers to sign off on a scope of identities within a window. TigerTrust captures the reviewer decisions and generates audit-grade evidence.

​
Campaign shape

name: Q3-2026-payments
scope:
  labels: { system: payments }
  kinds:  [aws_iam_role, sm_approle, tls_certificate]
reviewers:
  - group: payments-owners     # dynamic — resolves via SSO claims
  - user:  alice@example.com   # explicit backup
schedule:
  starts: 2026-09-01
  due:    2026-09-30
policy:
  no_response: revoke          # what happens if a reviewer never acts
  approve_requires: "1"        # per identity

​
Reviewer experience

Reviewers see one identity per row with:
  • Kind, source, name, last used, current permissions
  • The owner-of-record and any recent findings
  • Prior attestations
  • Three buttons: Certify, Modify (open a change ticket), Revoke
The default keyboard shortcut is j / k to move and 1 / 2 / 3 to decide — designed for campaigns with hundreds of rows.

​
Evidence export

At close, the campaign auto-generates:
  • A machine-readable JSON export (one row per identity, per decision, per reviewer).
  • A signed PDF summary with campaign metadata and per-reviewer sign-off.
  • A per-identity audit-log trail linking the campaign, the decision, and the resulting change (revocation, policy diff, ticket).
tt nhig reviews export --campaign=Q3-2026-payments --format=pdf > q3.pdf

​
Continuous vs discrete campaigns

  • Discrete — one scope, one deadline. Good for annual SOC 2 evidence.
  • Continuous — every new identity in scope gets added to the current window; reviewers see a rolling backlog. Good for operational drift control.

Findings

Findings feed into the next campaign automatically.

Ownership

Reviewers are usually owners — attestation counts as a review.