For your engineer

What Acciew reads, and the permissions it needs.

Short and exact. Everything on this page is also in the open-source code, which is the part of Acciew that touches your systems.

Each system: what is read, what is needed

Keycloak

What it reads

Realms, users, groups and group membership, realm roles and client roles, and the composite roles that connect them. Last sign-in, where the realm stores login events.

What it needs

One service account, a confidential client in one realm (the master realm, to read several), holding these read-only roles from the management client of every realm it reads: view-users, view-clients and view-realm, and view-events if you want last sign-in. The management client is realm-management, or <realm>-realm when the account lives in the master realm. A manage-* role works in place of the matching view-* role but grants more than Acciew uses. The query-* roles are not enough and are refused.

What it never does

Create, change or delete users, groups, roles or clients. It does not collect credentials, sessions or tokens either.

Good to know

Tested with Keycloak 26.4.7. Where a realm does not store login events, the answer is “unknown”, never “inactive”.

Source on GitHub

GitHub

What it reads

Organization members and their role, teams and team membership including nested teams, outside collaborators, installed applications, and each repository’s collaborators and team permissions with their level.

What it needs

A token from an organization owner of every organization it reads. A classic token needs read:org and repo. The owner token is needed because GitHub shows the default repository permission to owners only.

What it never does

Read code, issues, pull requests or activity. Change membership or permissions. The collector never writes, but the repo scope can: today the code, not the token, is what limits it.

Good to know

Last activity is not collected, on purpose: GitHub’s audit log is for Enterprise plans only. GitHub allows 5,000 requests an hour per token; a collection that runs out is marked incomplete, and a review cannot start from it. A GitHub App credential is not supported.

Source on GitHub

AWS

What it reads

IAM users, groups and roles, the policies attached to each, who may assume each role, and when each user and role was last used.

What it needs

A read-only IAM principal allowed to call iam:GetAccountAuthorizationDetails, iam:GenerateCredentialReport, iam:GetCredentialReport and iam:ListAccountAliases. The AWS-managed SecurityAudit policy covers all of them. sts:GetCallerIdentity needs no permission.

What it never does

Create, attach, detach or delete anything in IAM. GenerateCredentialReport only asks AWS to build the report and changes no access. It reads no S3 objects, databases or secrets.

Good to know

Every grant is coarse: it names the policy someone holds, not what that policy allows. Permission boundaries, service control policies and IAM Identity Center are not read.

Source on GitHub

Where it can run

Hosted by us, with your login details held in the service, or kept inside your network. On request, the whole of Acciew runs on your own servers instead.

Hosted, details in the serviceYou create the client, token or role with the permissions above and paste its details into Acciew. They are encrypted before they are stored (AES-256-GCM).
Hosted, details inside your networkThe details stay on your side; Acciew receives what was collected, not the credentials. The agent makes outbound HTTPS requests only and listens on no port.
Self-hosted, on requestThe whole product on your own servers, including the reports and the record. Reviewer email goes out through your own mail relay.

How data is kept

How the product keeps data today. Acciew holds no security certification or audit report yet.

  • History. The database refuses to change or delete the history of collections and decisions.
  • Between customers. Each customer’s data is separate. The database shows a customer only its own rows.
  • Retention and deletion. Set with each design partner during early access. Questions: hello@acciew.com

The open-source code

Everything that connects to your systems is open source (Apache-2.0), so you can read exactly what is requested before you grant anything.