flowchart TB Shared["User & Access Management UI
both processes live here; both write to the Audit Log"]:::shared subgraph LANEA["Access Review (routine, scheduled)"] direction TB A1["Review window opens"]:::routine A2["Admin sees every active account and scope in their territory"]:::routine A3{"Grant still needed?"}:::decide A4["Yes: grant reconfirmed, review timestamp reset"]:::routine A5["No / no response: grant flagged as stale"]:::routine A6["Admin revokes, or later reconfirms, the stale grant"]:::routine A1 --> A2 --> A3 A3 -->|yes| A4 A3 -->|no| A5 --> A6 end subgraph LANEB["Impersonation (exceptional, heavily audited)"] direction TB B1["System Admin initiates impersonation for support"]:::exc B2["Persistent banner: 'Impersonating: [user]' on every screen"]:::exc B3["Support action taken as the impersonated user"]:::exc B4["Action logged with an impersonation marker"]:::exc B5["Session ends; banner disappears"]:::exc B1 --> B2 --> B3 --> B4 --> B5 end Shared --> A1 Shared --> B1 classDef shared fill:#37474f,stroke:#1c2529,color:#fff,font-size:12px classDef routine fill:#2a9d8f,stroke:#1f7a6f,color:#fff,font-size:12px classDef decide fill:#f0d67a,stroke:#b8961f,color:#222,font-size:12px classDef exc fill:#e9a23b,stroke:#b8791f,color:#222,font-size:12px linkStyle default stroke:#999,stroke-width:2px