dsh-access-review-proof

Once an access-review campaign ends, the single most common audit question is deceptively narrow: did the campaign touch every declared entitlement, did each risk-based stage run in the prescribed order, and did every keep or revoke decision close into a clean post-review inventory? dsh-access-review-proof is an offline, deterministic verifier built to answer exactly that question. It never connects to live identity infrastructure, never approves, keeps, or revokes access, and never authenticates receipts. It simply takes a structured evidence document and checks it.

Ten checks cover the full surface: review start, completion, due date, closure, snapshot, and evaluation chronology; exact coverage of the declared entitlement set; risk-based stage counts with contiguous ordered decisions; independent reviewers for configured high-risk classes with self-review excluded; a common review binding across decisions, closures, and snapshot; one closure per entitlement that occurs after review completion; final keep and revoke decisions matching active or revoked closures; non-zero application receipts for every revocation; an exact active and revoked partition in the post-review snapshot; observer diversity and evidence freshness; and a security layer that rejects secrets and raw data, enforces workspace confinement, defends against symlink attacks, and verifies content-addressed read-back. The same headless core ships as a DSH tool bundle, a standalone MCP stdio server, a JavaScript API, and a CLI. Every report is redacted, content-addressed, and verified after writing.

The plugin is well suited for security and compliance teams who need to re-verify access-review evidence offline during an audit cycle, or who want a reproducible integrity check when filing review results as part of an audit trail. It is not an identity-governance platform: it does not approve or revoke access, authenticate receipts, query live directories, or prove that the supplied inventory is exhaustive. Its job is to say, clearly and deterministically, whether the evidence you submitted is internally consistent, complete against its own declared set, and properly closed.