What happens if a manager doesn't respond within the deadline?

The workflow sends up to 3 reminder notifications (every 24 hours by default). After the 7-day window closes, the cycle ends regardless of whether all managers responded. The compliance report reflects which reviews were completed and which were not.

What does it handle and what does it hand off to a human?

Harmony handles the full orchestration cycle: enumerating access, notifying managers, sending reminders, collecting responses, and generating the report. Actual access removal for rejected items is a follow-up action handled by IT outside this workflow.

Can it run for a subset of employees rather than everyone?

The current implementation runs for all employees by default. The employee_ids input parameter appears in the template for future scoping support, but the primary use case is a full-organization review.

What does it need to be connected to before it works?

The employee directory must include manager relationships so notifications can be routed correctly. Application access data must be populated in the Application Management module. The notification system (Slack or Teams) must be configured. The workflow template must be explicitly enabled per tenant (disabled by default).

All agents

Legal

Software Compliance Report

Runs periodic access reviews by having managers attest to each direct report's application access, then consolidates the results into an audit-ready record to support compliance requirements.

Book a demo How it works

Works with

One run, end to endResolved

1Scopes the review to the right employees using flexible filters such as employee classification, status, location, and more
2Pulls application access across all in-scope employees
3Reaches out to managers through their preferred communication channel to request attestation
4Tracks responses against a configurable deadline with automated reminders
5Consolidates the collected responses into a structured report
6Creates e a ticket with the report attached for IT and compliance review

Overview

What Software Compliance Report does

Software Compliance Report is Harmony's automated application access review workflow. Running on a weekly schedule, Harmony collects all employees and their current application access, notifies each manager to review and acknowledge or reject their direct reports' application permissions, generates a CSV compliance report from the responses, and creates an IT desk ticket with the results. This gives IT and compliance teams a recurring, evidence-backed record that application access has been reviewed - a critical requirement for many security and compliance frameworks.

Who it's for

Who Software Compliance Report Is For

Persona

IT admins and compliance teams who need to demonstrate that application access is periodically reviewed and certified by the relevant business owners (managers).

Pain point

Access reviews (user access certifications) are a recurring compliance burden - frameworks such as SOC 2, ISO 27001, and internal policies require that employee application access be reviewed periodically and certified by managers. Without automation, this requires manually gathering access lists, emailing managers, chasing responses, and compiling results. Harmony automates the full cycle.

How it works

How Software Compliance Report Works

Trigger

A cron schedule fires (default: weekly, Monday at 8 AM UTC). Schedule and timezone are configurable per tenant.

1
Employee and application enumeration
The workflow lists all employees and fetches each employee's current application access.
2
Manager notification
Harmony sends each manager a notification asking them to review and acknowledge or reject their direct reports' application permissions. Managers have a configurable window to respond (default: 7 days). Reminders are sent every 24 hours up to a maximum of 3 before the deadline.
3
Response collection
Manager responses (acknowledge / reject) are collected and tracked per employee-application pair.
4
CSV report
A compliance report (compliance_report.csv) is generated from all responses, including the outcome of each review.

Outcome

A ticket titled "Software Compliance Report" is created in the IT desk with the CSV attached, providing a trackable, dated record of the review cycle.

Capabilities

Automated access review orchestration

Runs the full manager-review cycle: collect access data → notify managers → collect responses → generate report → create ticket.

Manager notifications with deadline

Sends each manager a structured notification with a configurable deadline (default: 7 days from notification), making the review expectation clear.

Automated reminders

Sends reminder notifications every 24 hours (configurable) up to a maximum of 3 reminders before the deadline, reducing the need for manual follow-up.

7-day response window

Managers have a full week (168 hours; configurable) to review and submit their responses before the workflow closes the review cycle.

CSV compliance report

Generates a structured compliance CSV covering all employee-application-manager review outcomes, suitable for audit evidence.

IT desk ticket as audit trail

Creates a dated, trackable IT ticket with the compliance report attached - providing an auditable record of each review cycle.

Configurable schedule

Cron schedule and timezone are fully configurable per tenant (default: weekly on Monday).

Use cases

Main use cases

Weekly SOC 2 Access Certification

A company's SOC 2 Type II requirements mandate that application access be certified by managers on a recurring basis. The workflow runs weekly, notifies all managers to review their direct reports' access, collects responses within the 7-day window, and produces a compliance CSV attached to an IT ticket - creating the recurring certification record required by the audit.

Quarterly Access Review Cycle

IT runs a more thorough access review every quarter rather than weekly. The cron schedule can be changed to quarterly, and the response window and reminder intervals can be adjusted to give managers more time for a deeper review.

Detecting Unauthorized or Excessive Access

During the review, a manager notices an application assigned to a direct report that the employee no longer needs. The manager rejects that access in the review. The rejection is captured in the compliance CSV and creates a record for IT to follow up and remove the access.

Integrations

Integration	Role in the agent flow
Employee Directory / HRIS (internal)	Source of employee list and manager relationships used to route reviews to the correct managers
Application Management API (internal)	Source of current application access per employee - defines what each manager is asked to review
Service Desk (internal)	IT ticket created with compliance report CSV attached; serves as the auditable record of each review cycle
Notifications system (Slack/Teams)	Sends review requests and reminder notifications to managers

FAQ

It's a scheduled Harmony workflow (implemented as a native workflow rather than a YAML template). It runs on a cron schedule, orchestrates the full manager review cycle, and produces an audit-ready report. No user conversation is needed to start it.

Works alongside

More agents for the same team