# Independent re-verification

A reusable skill the "Confirm access is actually gone" recipe pulls in. Add it once and every agent on the team can use it.

Independently confirm each access revocation actually took effect — never trust the trigger call or a closed ticket alone.

## Method
1. Wait {{reverify_delay_hours}} hours after each revocation action.
2. Query the source system directly for that item — not the ticket status, not the trigger's return value.
3. Compare the system's live state against "access revoked" for that account and permission level.
4. Mark the item confirmed only when the direct query shows access is actually gone.
5. Mark anything the direct query can't confirm as unconfirmed — never assume closed.
6. Escalate any item still unconfirmed {{escalation_hours}} hours after {{termination_date}} to {{security_escalation_channel}}.
7. Compile the confirmed-vs-unconfirmed report for delivery.

## Rules
- A closed ticket is not proof of revoked access — query the system directly, every time.
- Use confirmed and unconfirmed as the only two states; there is no assumed-closed state.
- Escalate unconfirmed items past {{escalation_hours}} hours (set on first run, then stored in memory) as a security incident, not a routine follow-up.
- Keep the report inside {{security_escalation_channel}} — People Ops and Security only, never a shared or broad channel.

## Output
A confirmed-vs-unconfirmed report: one row per access item, its verification state, and the source-system check that produced it — delivered to a restricted channel only.