figma guide
Designing access review and certification campaigns UI in Figma: reviewers, decisions, and handoff
Design access review and certification campaign UI in Figma with reviewer queues, entitlement lists, approve/revoke flows, campaign deadlines, and Dev Mode specs for enterprise IAM admin.
- Published
- Updated
- Jul 20, 2026
- Read time
- 7 min
- Level
- Intermediate
Quick answer
Access review UI lets managers and app owners certify that each member still needs their roles, groups, and integrations—or revoke what they don’t. Design a campaign hub with scope (all admins, Salesforce users, API token holders); reviewer queue listing members or entitlements to certify; decision panel with Approve / Revoke / Delegate and mandatory justification; progress tracker for campaign completion; and auto-revoke when reviewers miss deadline. Start from the Figma guides hub and pair with team roles, SCIM provisioning, offboarding, audit log, and Dev Mode handoff.
Who this is for
- Product designers building certification campaigns, reviewer queues, and entitlement detail panels for enterprise IAM and Security admin consoles.
- Design system teams aligning review status badges with badges, tables, and progress indicators.
- Engineers implementing campaign scheduling, reviewer assignment, bulk approve, and automated revocation workflows tied to SCIM or internal RBAC.
Campaign hub layout
| Column | Content |
|---|---|
| Campaign | Q3 Admin role recert · Salesforce access · API token review |
| Scope | 142 members · 38 entitlements |
| Reviewers | Managers · App owners · Security Admin |
| Status | Active / Completed / Overdue |
| Progress | 78% decisions submitted |
| Due | 2026-08-15 |
CampaignHub
├── Header: Access reviews · [ New campaign ] [ Export evidence ] [ Templates ]
├── Summary: 2 active · 1 overdue · 412 pending decisions
├── Filters: Status · Scope type · Reviewer · Overdue
└── Row: Q3 Admin recert · 142 members · Due Aug 15 · 78% completeVerdict: campaigns are time-boxed events, not always-on settings—admins launch quarterly recerts with clear due dates and completion metrics.
Campaign builder (admin)
CampaignBuilder
├── Step 1: Scope · Entitlement type: Org roles · App: Admin console
├── Step 2: Population · All members with Admin or Billing Admin role
├── Step 3: Reviewers · Primary: Direct manager · Fallback: Security Admin
├── Step 4: Schedule · Start Jul 20 · Due Aug 15 · Reminders at 7d, 2d
├── Step 5: Auto-action · Revoke unreviewed access 48h after due (with warning)
└── [ Launch ] [ Save template ]| Scope type | Example population |
|---|---|
| Org roles | Everyone with Admin, Security Admin |
| App access | Salesforce, GitHub org, third-party apps |
| Groups / teams | Finance-approvers, Production-deploy |
| Privileged | Break-glass accounts, API keys |
| Custom query | Members inactive 90d but still entitled |
Templates: “Quarterly admin recert,” “Annual vendor app review,” “Post-offboarding stale access sweep.”
Reviewer queue (manager view)
Managers certify their reports’ access—not the whole org:
ReviewerQueue
├── Header: Your access reviews · Q3 Admin recert · Due in 12 days
├── Progress: 8 of 11 decisions submitted
├── Filters: Pending · Approved · Revoked · Delegated
└── Row: Alex Chen · Admin + Billing Admin · Last login 2d ago · [ Review ]| Column | Why it matters |
|---|---|
| Member | Who holds the access |
| Entitlements | Roles, groups, apps being certified |
| Last activity | Stale access signal—no login 90d |
| Risk flag | Privileged role, DLP exception, external contractor |
| Decision | Pending / Approved / Revoked / Delegated |
| Justification | Required on revoke; optional on approve |
Bulk actions: Approve all low-risk (with confirmation modal listing entitlements)—never bulk revoke without per-row review.
Use tables with sticky decision column; avatars for member rows.
Decision panel (single review)
AccessReviewPanel
├── Member: Alex Chen · Engineering · Manager: You
├── Entitlements under review:
│ ├── ☑ Admin (org role) · Granted 2024-03-01 · Last used 2026-07-18
│ ├── ☑ Billing Admin · Granted 2025-01-10 · Last used never
│ └── ☐ Production deploy group · Not in this campaign scope
├── Context: Last login Jul 18 · 3 [active sessions](/designing-active-sessions-and-device-management-ui-in-figma/)
├── Decision: ○ Approve all ● Revoke selected ○ Delegate to Security Admin
├── Justification (required if revoke): No longer needs billing access after team reorg
└── [ Submit decision ] [ Skip — escalate to Security ]| Decision | System action |
|---|---|
| Approve | Log certification; no permission change |
| Revoke | Trigger deprovision via SCIM or internal RBAC |
| Delegate | Reassign to app owner or Security Admin |
| Escalate | Flag for manual review—contractor, break-glass, conflicting roles |
Show entitlement history: who granted, when, last used—reviewers decide with evidence, not memory.
Link revoked items to audit log entries and optional member notification (“Your Billing Admin role was removed after access review”).
App-owner review (entitlement-centric)
Some campaigns review the entitlement, not each member—app owners certify the whole access list:
AppOwnerReview
├── App: Salesforce Production · Owner: @revops-admin
├── Entitlement list: 47 members with Production access
├── Columns: Member · Role in app · Last sync · Decision
├── Bulk: Approve 42 unchanged · Flag 5 for revoke
└── [ Submit app certification ]| Pattern | Reviewer |
|---|---|
| Manager-centric | Direct manager certifies each report |
| App-owner-centric | App owner certifies entire integration user list |
| Security-centric | Security Admin certifies custom roles and break-glass |
Hybrid campaigns common: managers review org roles; app owners review connected accounts and OAuth scopes.
Campaign progress and escalation
CampaignProgress
├── Overall: 78% complete · 31 reviewers overdue
├── By department: Eng 92% · Sales 61% · Finance 100%
├── Escalation: Auto-notify manager's manager at due minus 3 days
└── Auto-revoke queue: 14 entitlements pending (runs Aug 17 if no decision)| Milestone | UI treatment |
|---|---|
| Launch | Email + in-app banner to reviewers |
| 50% complete | Admin dashboard green progress |
| Reviewer overdue | Amber badge on reviewer row |
| Campaign overdue | Red org banner; optional posture gap |
| Auto-revoke pending | 48h warning to member + reviewer before execution |
Auto-revoke is sensitive—show preview list to Security Admin before batch job runs; log every revocation in audit log.
Posture and compliance linkage
| Control | Access review evidence |
|---|---|
| SOC2 CC6.1 | Quarterly admin recert completion report |
| Posture dashboard | ”Access review overdue” blocks green IAM score |
| Compliance export | Campaign roster: reviewer, decision, timestamp, justification |
| Vendor risk | App-owner cert tied to integration risk tier |
PostureGapCard — Access governance
├── Q3 Admin recert: 22% overdue · Due Aug 15
├── 14 entitlements queued for auto-revoke
└── [ View campaign ] [ Nudge overdue reviewers ]Pair with IP allowlist reviews when certifying remote admin access.
Comparison: access review vs offboarding vs role assignment
| Surface | Question answered |
|---|---|
| Access review | ”Should they still have this?” |
| Offboarding | ”Remove everything when they leave” |
| Team roles | ”Grant or change access now” |
Offboarding is immediate and total; access review is periodic and selective. Don’t reuse offboarding UI for certification—reviewers need approve path and justification, not only “Remove all.”
Common mistakes
| Mistake | Why it hurts | Fix |
|---|---|---|
| Reviewer sees entire org | Wrong person certifies | Manager or app-owner scoped queue |
| Approve with no context | Rubber-stamping | Show last login, grant date, usage |
| Revoke without justification | Audit gap | Required comment + audit log |
| No reminder cadence | Campaign stalls at 40% | 7d / 2d / overdue nudges |
| Auto-revoke without warning | Surprise lockouts | 48h member + reviewer notice |
| One UI for manager and app owner | Wrong mental model | Separate queue layouts by reviewer type |
| Campaign decoupled from SCIM | Revoke doesn’t propagate | Show sync status on revoke confirmation |
| Bulk approve hides entitlements | Admin keeps ghost access | Expand list in confirm modal |
| No export for auditors | SOC2 evidence gap | Compliance export per campaign |
| Same campaign for roles and OAuth | Reviewer confusion | Split scope or tabbed decision panel |
Recommended workflow
- Design campaign hub with scope, progress, and due date visibility.
- Build campaign builder with population filters, reviewer rules, and auto-revoke settings.
- Create manager reviewer queue with entitlement context and decision states.
- Add app-owner entitlement list view for integration certifications.
- Build decision panel with approve/revoke/delegate and required justification.
- Wire overdue campaigns to security posture gaps and escalation paths.
- Annotate revoke side effects and audit events in Dev Mode.
FAQ
How often to run admin recertification?
Quarterly for privileged roles, annual for standard app access—configurable templates in campaign builder.
Manager on leave during campaign?
Fallback reviewer to skip-level manager or Security Admin—set in campaign builder Step 3.
Certify API keys separately?
Yes—dedicated scope type; owner certifies each token with last-used timestamp.
Contractor access in same campaign?
Include with flag—reviewers see “Contractor · ends Sep 30”; auto-revoke aligns with contract end.
Link to custom roles?
App-owner campaign certifies who holds each custom role template—revoke updates role assignment, not template definition.
Next steps
- Design team member roles and permissions UI in Figma — grant path before certify path
- Design SCIM and directory sync UI in Figma — revoke propagation
- Design member offboarding and deprovisioning UI in Figma — immediate vs periodic removal
- Design audit log and security activity UI in Figma — certification evidence trail
- Design security posture dashboard and compliance checklist UI in Figma — overdue campaign gaps
§ Keep reading