Internal audit asks whether sealed-case RAG collections stay limited to authorized clerks. Which practice answers that question?

Internal audit's question about whether sealed-case RAG collections stay limited to authorized clerks is answered by access auditing: quarterly reviews confirming only authorized clerks can query those collections. Entitlement reviews compare identity-provider groups, RAG ACLs, and service principals against the official roster for sealed matters, then remediate orphans, contractors past end-date, and over-broad roles. For courts or clerk systems, sealed-case corpora are highly sensitive; periodic access attestation is how the city proves least privilege rather than assuming confirming only who can edit sealed-case collections is sufficient for query access control. Access logs support the review by showing who actually queried what. Running quarterly access reviews confirming authorized clerks can query sealed-case collections fails because it confirms access without proving exclusivity — showing authorized clerks retain query access does nothing to detect extra entitlements for unauthorized clerks, lingering contractors, or over-broad roles that still allow querying sealed-case collections. Running quarterly access reviews confirming only authorized clerks can edit sealed-case collections fails because it audits the wrong permission — limiting who can edit says nothing about who can query sealed-case collections, so over-broad query entitlements would remain undetected. Running quarterly access reviews confirming only human identities can query sealed-case collections fails because it checks identity type rather than authorization: showing query access is human-only says nothing about whether those humans are authorized clerks, and it leaves service accounts and API keys that can query sealed-case collections out of the authorization check. Exam caveat: Access reviews must recur on a defined cadence and cover both human users and machine identities (API keys, service accounts) that can query RAG. Confirming only who can edit sealed-case collections, or confirming only that query access is human-only, misses exactly the unauthorized query entitlements most likely to drift unnoticed. Quarterly is a common cadence, but high-risk sealed data may need more frequent review after role changes. Operational check: Schedule quarterly access reviews confirming who can query sealed-case RAG, not just who can edit sealed-case collections; reconcile IdP groups to clerk rosters; remove excess entitlements; keep access logs enabled; include service principals and API keys alongside human accounts; and report results to internal audit with evidence of remediation.