People reach a client's record in three ways, and Access Review shows all three side by side:

Org — a role with organisation-wide access, which covers every client.
Direct — a role or person assigned in that client's own permissions. It stays until someone removes it.
Shift — a confirmed or in-progress shift with the client, or a shift at the client's facility. It is temporary, and when it starts and ends follows your organisation's shift access policy.

Any one route is enough. Administrators with the access review permission see everyone; anyone else opening the page sees only their own access.

Step 1
Open Access Review
In the side menu, click Access Review.
Step 2
Choose what to review
It opens on Users, one row per person with the clients, facilities and forms they can reach. Clients, Facilities and Forms turn the same question round. How … access works above the table explains the routes, with examples.
Step 3
Read the Clients tab
Each client shows how many people reach it through each route. Org reads All when an organisation-wide role covers every client; Direct counts people assigned to that client; Total counts each person once.
Step 4
Shift access
Shift Access splits into people with a shift with this client and people with a shift at the client's facility. A facility shift covers every client at that facility.
Step 5
When shift access starts and ends
The line above the table says your organisation's policy — for example from shift acceptance until the timesheet is approved. Configure takes you to the setting in Organisation settings.
Step 6
Open a client
Click a client to see each person who can reach them. Each row ticks Org, Direct or Shift, with the role or number of shifts underneath.
Step 7
Shifts left open
A red Shift tick, marked Needs attention, is a shift still In Progress after its scheduled end — usually a missed clock-out. It is still granting access, so these rows are listed first.
Step 8
Change direct access
Edit Direct Permissions opens the client's permissions, where you add or remove the roles and people assigned to them. Organisation-wide access is changed on the role instead, and shift access follows the roster.
Step 9
Checking one person
On the Users tab, click a person to see every client, facility and form they can reach. A red row there means one of their shifts needs attention. An amber note above the table lists anyone who can read responses on every form.