Access register
Keep a record of the systems, accounts, badges and keys people hold, and follow each access until it is removed and checked.
On this page
The access register is your written record of who has access to what: apps and shared logins, doors, badges and keys. You record when access is requested, granted and removed, and a colleague can check each report. It helps you make sure that nobody keeps access after they leave.
ValiCrew records your reports and checks. It does not control or revoke access in other systems, and you never enter passwords in it.
Admin, HR and Operations can see, record and verify access. A custom role needs access_register.view to see the register, access_register.manage to record access and access_register.verify to verify reports.
Add systems and accounts
- Go to Access register and open Systems and locations. Choose Add system or location, enter its Name, choose the Classification (Digital system or Physical location) and the Responsible owner, then choose Submit.
- Open Accounts and access items and choose Add account or access item.
- Choose the System or location and the Classification: Individual account, Shared account, Service account, Badge or Key.
- Add a Private account label, the Account identifier and the Responsible owner. For a badge or a key, you can link the Physical asset (optional).
- If the login lives in a password manager, add the Password-manager item reference: only the item's locator, never the password itself.
- Choose Submit.
An account's classification cannot be changed later: create a new account instead. To retire a system, use Archive from its menu; Restore brings it back.
Record access
- Open Access held and choose Record access action, or open an account or a grant and choose it there.
- Choose the Account or access item, then the action in Record access action.
- To request or grant access, choose the Holder type (Staff engagement, Third parties or Client) and the Holder. For an organisation, you can pick a Named contact (optional).
- Add the Expected expiry, the Review date and the Access details or level if they apply.
- Set the Actual date (leave blank if unknown). Add the Report source and Notes, and a Reason where the action needs one.
- Choose Submit.
Each grant moves through these states:
| State | What it means |
|---|---|
| Requested | Access was asked for. |
| Reported granted | Someone reported that access was given. |
| Revocation requested | Removal was asked for and is not yet confirmed. |
| Reported revoked | Someone reported that access was removed. |
| Cancelled request | The request was withdrawn. |
Other actions include Amend access details, Record access review, Change responsible owner, Report service enabled and Report service disabled for service accounts, and Record rotation or No rotation needed after someone leaves a shared account.
Verify or dispute a report
A report is only what someone said happened. To check it, a different person chooses Independently verify report on the account or grant and picks the Exact report. You cannot verify your own report.
If a report is wrong, choose Dispute or correct report in Record access action, pick the report and give the reason. The grant is then flagged under Needs attention.
Follow what needs attention
Go to Access register and open Needs attention. It lists the access that needs a follow-up, with chips saying why, for example:
| Reason | What it means |
|---|---|
| Revocation pending | Removal was requested and not yet reported done. |
| Expiry passed | The expected expiry has passed and removal is not confirmed. |
| Review overdue | The review date has passed. |
| Holder inactive | The holder has left or the relationship has ended. |
| Contact changed | The named contact changed or was deactivated. |
| Disputed | A report was disputed and needs reassessing. |
| Owner unavailable | The responsible owner can no longer act for this company. |
Shared accounts, badges and keys that need a follow-up, such as a password change after someone left, are listed there too.
Returning equipment and removing access are separate. Recording a returned badge on the asset does not remove the access, and reporting access revoked does not return the badge. Record both.
For assets and their custody, see Assets and vehicles.