When an auditor asks how you control access, a screenshot of today's permission sets is not enough. They want to see what changed over the period, who changed it, and that someone looked at it. Advanced Permissions Management (APM) keeps that trail as a by-product of normal work. This page shows what to hand over and where to find it.
| The auditor asks | Show this | Where |
|---|---|---|
| Who changed this permission set, and when? | Who Last Changed What for the set, or the Change Explorer filtered on the set. | Change history |
| What exactly changed? | The permissions before and after in the Change Explorer, or Version Compare between two dates. | Change history |
| How do you know that changes were looked at? | The list of completed reviews with their period, status counts and comments. | Reviewing changes |
| What did you decide about suspicious changes? | The Change Explorer filtered on Review Status Flagged, with the review comments. | Reviewing changes |
| Do app updates change permissions? | The Change Explorer filtered on Changed By App Update. | App updates |
| Can you undo a wrong change? | The rollback wizard with its preview, and the rollback entry in the history. | Rollback |
| Do you check the quality of your permission sets? | The batch quality result with findings per rule. | Quality checks |
| How far back does your trail go? | The reset history, and the Change Explorer with source Archived. | Baseline reset |
| How many users have SUPER? | The Role Center headline that counts SUPER users. | Dashboard |
For a period such as a financial year:
For a worked example of answering one question in detail, see Investigate a surprise permission.
Evidence works best as a routine. A review completed every month, each with comments, is a stronger story than one big review right before the audit.
The trail proves what was recorded and what people concluded. Keep the limits in mind, and say them out loud to the auditor, because they make the evidence more credible:
The person who prepares the evidence needs the permission set Use Advanced Permissions Management and a registered trial or license. See Roles and permissions. Consider letting someone other than the person who edits permission sets complete the reviews.